Merge pull request #765 from actions/juxtin/allow-slashes-in-purls

Allow slashes in purl package names

__tests__/purl.test.ts

@@ -44,6 +44,30 @@ test('parsePURL table test', () => {
         error: null
       }
     },
+    {
+      purl: 'pkg:golang/gopkg.in/DataDog/[email protected]',
+      // Note: this purl is technically invalid, but we can still parse it
+      expected: {
+        type: 'golang',
+        namespace: 'gopkg.in',
+        name: 'DataDog/dd-trace-go.v1',
+        version: '1.63.1',
+        original: 'pkg:golang/gopkg.in/DataDog/[email protected]',
+        error: null
+      }
+    },
+    {
+      purl: 'pkg:golang/github.com/pelletier/go-toml/v2',
+      // Note: this purl is technically invalid, but we can still parse it
+      expected: {
+        type: 'golang',
+        namespace: 'github.com',
+        name: 'pelletier/go-toml/v2',
+        version: null,
+        original: 'pkg:golang/github.com/pelletier/go-toml/v2',
+        error: null
+      }
+    },
     {
       purl: 'pkg:npm/%40ns%20foo/n%40me@1.%2f2.3',
       expected: {

src/purl.ts

@@ -46,7 +46,10 @@ export function parsePURL(purl: string): PackageURL {
     namePlusRest = parts[1]
   } else {
     result.namespace = decodeURIComponent(parts[1])
-    namePlusRest = parts[2]
+    // Add back the '/'s to the rest of the parts, in case there are any more.
+    // This may violate the purl spec, but people do it and it can be parsed
+    // without ambiguity.
+    namePlusRest = parts.slice(2).join('/')
   }
   const name = namePlusRest.match(/([^@#?]+)[@#?]?.*/)
   if (!result.namespace && !name) {