1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
|
# frozen_string_literal: true
# MIT License
#
# Copyright (c) 2021 package-url
# Portions Copyright 2022 Gitlab B.V.
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.
module Sbom
class PackageUrl
class Encoder
include StringUtils
def initialize(package)
@type = package.type
@namespace = package.namespace
@name = package.name
@version = package.version
@qualifiers = package.qualifiers
@subpath = package.subpath
@io = StringIO.new
end
def encode
encode_scheme!
encode_type!
encode_name!
encode_version!
encode_qualifiers!
encode_subpath!
io.string
end
private
attr_reader :io
def encode_scheme!
io.write('pkg:')
end
def encode_type!
# Append the type string to the purl as a lowercase ASCII string
# Append '/' to the purl
io.write(@type)
io.write('/')
end
def encode_name!
# If the namespace is empty:
# - Apply type-specific normalization to the name if needed
# - UTF-8-encode the name if needed in your programming language
# - Append the percent-encoded name to the purl
#
# If the namespace is not empty:
# - Strip the namespace from leading and trailing '/'
# - Split on '/' as segments
# - Apply type-specific normalization to each segment if needed
# - UTF-8-encode each segment if needed in your programming language
# - Percent-encode each segment
# - Join the segments with '/'
# - Append this to the purl
# - Append '/' to the purl
# - Strip the name from leading and trailing '/'
# - Apply type-specific normalization to the name if needed
# - UTF-8-encode the name if needed in your programming language
# - Append the percent-encoded name to the purl
if @namespace.present?
normalized_namespace = Normalizer.new(type: @type, text: @namespace).normalize_namespace
io.write(encode_segments(normalized_namespace, &:empty?))
io.write('/')
end
normalized_name = Normalizer.new(type: @type, text: strip(@name, '/')).normalize_name
io.write(URI.encode_www_form_component(normalized_name, Encoding::UTF_8))
end
def encode_version!
return if @version.nil?
# - Append '@' to the purl
# - UTF-8-encode the version if needed in your programming language
# - Append the percent-encoded version to the purl
io.write('@')
io.write(URI.encode_www_form_component(@version, Encoding::UTF_8))
end
def encode_qualifiers!
return if @qualifiers.nil? || encoded_qualifiers.empty?
io.write('?')
io.write(encoded_qualifiers)
end
def encoded_qualifiers
@encoded_qualifiers ||= @qualifiers.filter_map do |key, value|
next if value.empty?
next "#{key.downcase}=#{value.join(',')}" if key == 'checksums' && value.is_a?(::Array)
"#{key.downcase}=#{URI.encode_www_form_component(value, Encoding::UTF_8)}"
end.sort.join('&')
end
def encode_subpath!
return if @subpath.nil? || encoded_subpath.empty?
io.write('#')
io.write(encoded_subpath)
end
def encoded_subpath
@encoded_subpath ||= encode_segments(@subpath) do |segment|
# Discard segments which are blank, `.`, or `..`
segment.empty? || segment == '.' || segment == '..'
end
end
end
end
end
|
