Invalid purl passes as valid

[surendrapathak]

PURL - 'pkg:maven/org.apache.commons:io@1.3.4' passes as valid

p.PackageURL.fromString('pkg:maven/org.apache.commons:io@1.3.4')
PackageURL {
type: 'maven',
name: 'org.apache.commons:io',
namespace: null,
version: '1.3.4',
qualifiers: null,
subpath: null
}

However, it shouldn't be because the namespace is not percent-encoded.

[jdalton]

If you .toString() it then it's encoded:

p.PackageURL.fromString('pkg:maven/org.apache.commons:io@1.3.4').toString()
// => 'pkg:maven/org.apache.commons%3Aio@1.3.4'

[surendrapathak]

Hi @jdalton - The concern is that PURL such as:

pkg:maven/org.apache.commons:io@1.3.4

should be marked invalid for violating the namespace rule:

However, because packageurl-js parses these successfully, they show up in SBOM as valid entries, causing identification issues.