Enforce namespace restrictions

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "packageurl"
-version = "0.5.0"
+version = "0.6.0-rc.1"
 edition = "2021"
 authors = [
     "Martin Larralde <[email protected]>",
@@ -16,20 +16,19 @@ categories = ["parser-implementations", "encoding", "development-tools"]
 rust-version = "1.82.0"
 
 [dependencies]
-percent-encoding = "2.1.0"
-thiserror = "2.0.12"
+percent-encoding = "2"
+thiserror = "2"
 
-memchr = { version = "2.4.0", optional = true }
-serde = { version = "1.0.0", optional = true, features = ["derive"] }
+memchr = { version = "2", optional = true }
+serde = { version = "1", optional = true, features = ["derive"] }
 
 [features]
 default = []
 
 [dev-dependencies]
-criterion = "0.5.1"
-rstest = "0.25.0"
-serde = { version = "1.0.0", features = ["derive"] }
-serde_json = "1.0.13"
+criterion = "0.7"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
 url = "2"
 
 [[bench]]

src/errors.rs

@@ -12,6 +12,8 @@ pub enum Error {
     InvalidKey(String),
     #[error("missing name")]
     MissingName,
+    #[error("no namespace allowed for type {0:?}")]
+    TypeProhibitsNamespace(String),
     #[error("invalid namespace component: {0:?}")]
     InvalidNamespaceComponent(String),
     #[error("missing scheme")]

src/purl.rs

@@ -66,7 +66,7 @@ impl<'a> PackageUrl<'a> {
     /// cannot contain spaces.
     ///
     /// # Name
-    /// The package name will be canonicalize depending on the type: for instance,
+    /// The package name will be canonicalized depending on the type: for instance,
     /// 'bitbucket' packages have a case-insensitive name, so the name will be
     /// lowercased if needed.
     ///
@@ -152,20 +152,31 @@ impl<'a> PackageUrl<'a> {
     }
 
     /// Assign a namespace to the package.
-    pub fn with_namespace<N>(&mut self, namespace: N) -> &mut Self
+    pub fn with_namespace<N>(&mut self, namespace: N) -> Result<&mut Self>
     where
         N: Into<Cow<'a, str>>,
     {
+        // Fail if namespace is prohibited for this type
+        match self.ty.as_ref() {
+            "bitnami" | "cargo" | "cocoapods" | "conda" | "cran" | "gem" | "hackage" | "mlflow"
+            | "nuget" | "oci" | "pub" | "pypi" => {
+                return Err(Error::TypeProhibitsNamespace(self.ty.to_string()));
+            }
+            _ => {}
+        }
+
+        // Lowercase namespace if needed for this type
         let mut n = namespace.into();
         match self.ty.as_ref() {
-            "bitbucket" | "deb" | "github" | "golang" | "hex" | "rpm" => {
+            "apk" | "bitbucket" | "composer" | "deb" | "github" | "golang" | "hex" | "qpkg"
+            | "rpm" => {
                 n = to_lowercase(n);
             }
             _ => {}
         }
 
         self.namespace = Some(n);
-        self
+        Ok(self)
     }
 
     /// Clear the namespace
@@ -175,12 +186,12 @@ impl<'a> PackageUrl<'a> {
     }
 
     /// Assign a version to the package.
-    pub fn with_version<V>(&mut self, version: V) -> &mut Self
+    pub fn with_version<V>(&mut self, version: V) -> Result<&mut Self>
     where
         V: Into<Cow<'a, str>>,
     {
         self.version = Some(version.into());
-        self
+        Ok(self)
     }
 
     /// Clear the version
@@ -263,10 +274,10 @@ impl FromStr for PackageUrl<'static> {
 
         let mut purl = Self::new(ty, name)?;
         if let Some(ns) = namespace {
-            purl.with_namespace(ns);
+            purl.with_namespace(ns)?;
         }
         if let Some(v) = version {
-            purl.with_version(v);
+            purl.with_version(v)?;
         }
         if let Some(sp) = subpath {
             purl.with_subpath(sp)?;
@@ -367,7 +378,9 @@ mod tests {
         let purl_string = PackageUrl::new("type", "name")
             .unwrap()
             .with_namespace("name/space")
+            .unwrap()
             .with_version("version")
+            .unwrap()
             .with_subpath("sub/path")
             .unwrap()
             .add_qualifier("k1", "v1")

tests/spec/macros.rs

@@ -46,11 +46,11 @@ macro_rules! spec_tests {
                 .unwrap();
 
                 if let Some(ref ns) = TEST_CASE.namespace {
-                    purl.with_namespace(ns.as_ref());
+                    purl.with_namespace(ns.as_ref()).unwrap();
                 }
 
                 if let Some(ref v) = TEST_CASE.version {
-                    purl.with_version(v.as_ref());
+                    purl.with_version(v.as_ref()).unwrap();
                 }
 
                 if let Some(ref sp) = TEST_CASE.subpath {