URI encode/decode in conformance with RFC 3986

Author: Pablo Galego

src/main/java/com/github/packageurl/PackageURL.java

@@ -21,12 +21,12 @@
  */
 package com.github.packageurl;
 
+import java.io.ByteArrayOutputStream;
 import java.io.Serializable;
 import java.io.UnsupportedEncodingException;
 import java.net.URI;
 import java.net.URISyntaxException;
-import java.net.URLDecoder;
-import java.net.URLEncoder;
+import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.Collections;
@@ -432,16 +432,38 @@ private String canonicalize(boolean coordinatesOnly) {
      * @return an encoded String
      */
     private String percentEncode(final String input) {
-        try {
-            return URLEncoder.encode(input, UTF8)
-                    .replace("+", "%20")
-                    // "*" is a reserved character in RFC 3986.
-                    .replace("*", "%2A")
-                    // "~" is an unreserved character in RFC 3986.
-                    .replace("%7E", "~");
-        } catch (UnsupportedEncodingException e) {
-            return input; // this should never occur
+        return uriEncode(input, StandardCharsets.UTF_8);
+    }
+
+    private static String uriEncode(String source, Charset charset) {
+        if (source == null || source.length() == 0) {
+            return source;
         }
+
+        StringBuilder builder = new StringBuilder();
+        for (byte b : source.getBytes(charset)) {
+            if (isUnreserved(b)) {
+                builder.append((char) b);
+            }
+            else {
+                // Substitution: A '%' followed by the hexadecimal representation of the ASCII value of the replaced character
+                builder.append('%');
+                builder.append(Integer.toHexString(b).toUpperCase());
+            }
+        }
+        return builder.toString();
+    }
+
+    private static boolean isUnreserved(int c) {
+        return (isAlpha(c) || isDigit(c) || '-' == c || '.' == c || '_' == c || '~' == c);
+    }
+
+    private static boolean isAlpha(int c) {
+        return ((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z'));
+    }
+
+    private static boolean isDigit(int c) {
+        return (c >= '0' && c <= '9');
     }
 
     /**
@@ -455,17 +477,33 @@ private String percentDecode(final String input) {
         if (input == null) {
             return null;
         }
-        try {
-            final String decoded = URLDecoder.decode(input, UTF8);
-            if (!decoded.equals(input)) {
-                return decoded;
-            }
-        } catch (UnsupportedEncodingException e) {
-            return input; // this should never occur
+        final String decoded = uriDecode(input);
+        if (!decoded.equals(input)) {
+            return decoded;
         }
         return input;
     }
 
+    public static String uriDecode(String source) {
+        if (source == null) {
+            return source;
+        }
+        int length = source.length();
+        StringBuilder builder = new StringBuilder();
+        for (int i = 0; i < length; i++) {
+            if (source.charAt(i) == '%') {
+                String str = source.substring(i + 1, i + 3);
+                char c = (char) Integer.parseInt(str, 16);
+                builder.append(c);
+                i += 2;
+            }
+            else {
+                builder.append(source.charAt(i));
+            }
+        }
+        return builder.toString();
+    }
+
     /**
      * Given a specified PackageURL, this method will parse the purl and populate this classes
      * instance fields so that the corresponding getters may be called to retrieve the individual

src/test/resources/test-suite-data.json

@@ -311,6 +311,18 @@
     "subpath": null,
     "is_invalid": false
   },
+  {
+    "description": "valid debian purl containing a plus in the name and version",
+    "purl": "pkg:deb/debian/g++-10@10.2.1+6",
+    "canonical_purl": "pkg:deb/debian/g%2B%2B-10@10.2.1%2B6",
+    "type": "deb",
+    "namespace": "debian",
+    "name": "g++-10",
+    "version": "10.2.1+6",
+    "qualifiers": null,
+    "subpath": null,
+    "is_invalid": false
+  },
   {
     "description": "checks for invalid qualifier keys",
     "purl": "pkg:npm/myartifact@1.0.0?in%20production=true",