Skip to content

URL quoting specification issue #52

@milux

Description

@milux

In https://github.com/package-url/vers-spec/blob/main/VERSION-RANGE-SPEC.md#normalized-canonical-representation-and-validation it is stated that

If a version in a <version-constraint> contains separator or comparator characters (i.e. ><=!*|), it must be quoted using the URL quoting rules. This should be rare in practice.

I think this causes a problem:
There might be a versioning scheme allowing/using the percent sign (%) as a normal character, and versions of such scheme may contain valid sequences that look like URL quoting, but in fact aren't. This will lead to an error as such "quoting" will be decoded during parsing, although it was never meant to encode anything.

This is also related to the space issue @tschmidtb51 mentions in #50, which causes a similar problem for schemes that intentionally include whitespace which COULD be significant for such a particular scheme.

In order to fix both of this issues quick and dirty, the list of characters given in the spec MUST be extended to ><=!*|% plus space (whatever "space" means).

Additionally, "space" must be defined as well in order to have a clean spec. It should be clarified if that's ASCII pos 20 or all whitespace chars in ASCII, or, much worse, any whitespace in valid encoding (not an issue if only ASCII is allowed, but what if a versioning scheme uses Unicode? 🙈)

Needless to say, if a consensus is reached to only allow canonized input (#50), part of this issue dissolves automatically.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions