Questions on encoding

[pombredanne]

from @maxhbr in #176 (comment)

A follow-up question, that is not scope of this PR, would be:

given the PURL pkg:swift/github.com%2FAlamofire/Alamofire@5.4.3 is pkg:swift/github.com/Alamofire/Alamofire@5.4.3 its canonical form?
If yes, it should be added to the test cases.

Or, for having more fun and with looking at #63 : what is the canonical form of pkg:golang/github.com%2Frussross%2Fblackfriday%2Fv2@v2.1.0?

[ppkarwasz]

The string pkg:swift/github.com%2FAlamofire/Alamofire@5.4.3 is not a valid PURL, since it contains an encoded slash / in the namespace and path segments can not contain slashes.

[pombredanne]

Good point. One more reason why namespace and name are crying to be merged in one :]

[ppkarwasz]

For me this example is the motivation why we spent so much time specifying the rules of character encoding: differences in the way different software handles encoding are a perfect vector for path traversal attacks. In the case of PURL, these would be supply chain attacks, e.g.:

pkg:swift/github.com/Alamofire/..%2F../example.com/Alamofire/Alamofire