Repository navigation
PackageURL type not being validated #155
Description
Activity
- added a commit that references this issue
on Apr 23, 2026 related: #229
The library has been originally designed to be flexible when parsing. There is a separate set of validation methods (validate and validate_string)
This one seems to have been fixed?
>>> packageurl.PackageURL.from_string("pkg:111_^5/example") Traceback (most recent call last): File "<python-input-68>", line 1, in <module> packageurl.PackageURL.from_string("pkg:111_^5/example") ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^ File "/nix/store/v3mx6lav0f5w28qg1q1qzb52lmva7dbz-python3-3.13.12-env/lib/python3.13/site-packages/packageurl/__init__.py", line 603, in from_string raise ValueError( f"purl type must be composed only of ASCII letters and numbers, period, dash and underscore: {type_!r}." ) ValueError: purl type must be composed only of ASCII letters and numbers, period, dash and underscore: '111_^5'.
The PackageURL spec includes a list of requirements for a
typeto be considered valid:Therefore, the following should not be possible:
Spec taken from: https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst