package-url / packageurl-go / 32365331253

89%

master: 89%

Pull #95

github

Reject npm purl with bare scope and no name

Since v0.1.5, separateNamespaceNameVersion skips the missing-name guard
for npm so that scoped packages such as "pkg:npm/@babel/core" parse. That
exception is too broad: a remainder like "@4.17.21" has a leading '@' but
no '/', so it is a bare scope with no name, yet it was accepted with
name="@4.17.21" and no error. In v0.1.3 the same input correctly returned
"purl is missing name".

Add a narrow npm-only guard: when the remainder starts with '@' and
contains no '/', there is no scope/name separator, so return the
missing-name error. Valid scoped forms ("pkg:npm/@scope/name@1.0.0") and
unscoped forms ("pkg:npm/lodash@4.17.21") are unaffected because they
either contain a '/' or do not start with '@'. Other purl types are
untouched: they already reject a leading '@' through the existing guard.

Add TestNpmScopeWithoutName covering the regression and the valid cases.

Fixes #91

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>

3 of 3 new or added lines in 1 file covered. (100.0%)

440 of 495 relevant lines covered (88.89%)

1316.68 hits per line