-
Notifications
You must be signed in to change notification settings - Fork 6
Description
In https://github.com/package-url/vers-spec/blob/main/VERSION-RANGE-SPEC.md#normalized-canonical-representation-and-validation it is stated that
If a
versionin a<version-constraint>contains separator or comparator characters (i.e.><=!*|), it must be quoted using the URL quoting rules. This should be rare in practice.
I think this causes a problem:
There might be a versioning scheme allowing/using the percent sign (%) as a normal character, and versions of such scheme may contain valid sequences that look like URL quoting, but in fact aren't. This will lead to an error as such "quoting" will be decoded during parsing, although it was never meant to encode anything.
This is also related to the space issue @tschmidtb51 mentions in #50, which causes a similar problem for schemes that intentionally include whitespace which COULD be significant for such a particular scheme.
In order to fix both of this issues quick and dirty, the list of characters given in the spec MUST be extended to ><=!*|% plus space (whatever "space" means).
Additionally, "space" must be defined as well in order to have a clean spec. It should be clarified if that's ASCII pos 20 or all whitespace chars in ASCII, or, much worse, any whitespace in valid encoding (not an issue if only ASCII is allowed, but what if a versioning scheme uses Unicode? 🙈)
Needless to say, if a consensus is reached to only allow canonized input (#50), part of this issue dissolves automatically.