phylum-dev / purl

Package URL implementation for Rust

PURL

Introduction

This is a Rust implementation of Package URL. See purl/README.md for details.

Formatting

This project uses some nightly rustfmt settings. You can run cargo +nightly fmt or cargo xtask fmt to format the code.

Testing

The purl_test crate contains a test suite automatically generated from the official PURL test suite. It can be regenerated by running cargo xtask codegen.

Documentation

The documentation can be generated by running either cargo doc or cargo xtask doc. cargo xtask doc uses the nightly rustdoc to generate output more similar to docs.rs.

purl's Issues

Fails to build with `default-features = false`

Overview

When added as a dependency in another project with default-features = false, or when running cargo build --no-default-features, the crate fails to build:

error[E0432]: unresolved import `smartstring`
  --> /home/shnatsel/.cargo/registry/src/index.crates.io-6f17d22bba15001f/purl-0.1.1/src/lib.rs:12:5
   |
12 | use smartstring::{LazyCompact, SmartString, SmartStringMode};
   |     ^^^^^^^^^^^ use of undeclared crate or module `smartstring`

For more information about this error, try `rustc --explain E0432`.

How To Reproduce

Steps to reproduce this behavior:

1. cargo build --no-default-features

Expected Behavior

No compilation failures

Qualifiers are not percent-encoded correctly

Overview

builder.with_qualifier("vcs_url", "git+https://github.com/rustsec/rustsec.git@6f82509cb43a");

ends up encoded as vcs_url=git+https://github.com/rustsec/rustsec.git%406f82509cb43a - note the non-escaped + symbol.

By contrast, the official spec provides an example where the + sign is percent-encoded: pkg:generic/bitwarderl?vcs_url=git%2Bhttps://git.fsfe.org/dxtr/bitwarderl%40cc55108da32

Expected Behavior

The correct percent encoding character set for URL parameters being used, matching the URL and PURL specifications.

Percent signs are not percent encoded

Overview

pkg:brew/openssl%[email protected] parses correctly but then incorrectly serializes as pkg:brew/openssl%[email protected] (openssl%401.1 turns into [email protected]).

Expected Behavior

Percent signs in input should be percent encoded such that the serializing the PURL and parsing it again produces the same result.

Additional Context

althonos/packageurl.rs has the same problem, probably because both implementations use the same crate for encoding. It's surprising that the percent_encoding crate does not automatically percent encode percent signs since encoding a string containing percent signs and not encoding the percent signs can change the meaning of the string. servo/rust-url#822 says this is the expected behavior, but then how it's supposed to work is unclear.

The URL spec says

Of the possible values for the percentEncodeSet argument only two end up encoding U+0025 (%) and thus give “roundtripable data”: component percent-encode set and application/x-www-form-urlencoded percent-encode set. The other values for the percentEncodeSet argument — which happen to be used by the URL parser — leave U+0025 (%) untouched and as such it needs to be percent-encoded first in order to be properly represented.

Does that mean when serializing you're expected to percent encode everything twice? Once just for percent signs and then once for everything else? What is the difference between that and having percent in the percent encode set to begin with? Is it because the URL spec works with partially decoded strings so those encodings happen at different times?