Fix parsing of npm purls with namespace #93

.github/workflows/ci.yml

@@ -11,11 +11,11 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
         python-version:
+          - "3.11"
           - "3.10"
           - "3.9"
           - "3.8"
           - "3.7"
-          - "3.6"
 
     steps:
       - name: Checkout

CHANGELOG.rst

@@ -1,6 +1,12 @@
 Changelog
 =========
 
+0.10.5 (2022-11-29)
+-------------------
+
+- Fixed `PackageURL.from_string` to properly handle npm purls
+  with namespace.
+
 0.10.4 (2022-10-17)
 -------------------
 

src/packageurl/__init__.py

@@ -374,6 +374,15 @@ def from_string(cls, purl):
             raise ValueError(msg)
 
         path = path.lstrip("/")
+
+        namespace = ""
+        # NPM purl have a namespace in the path
+        # and the namespace in an npm purl is
+        # different from others because it starts with `@`
+        # so we need to handle this case separately
+        if type == "npm" and path.startswith("@"):
+            namespace, sep, path = path.partition("/")
+
         remainder, sep, version = path.rpartition("@")
         if not sep:
             remainder = version
@@ -382,9 +391,8 @@ def from_string(cls, purl):
         ns_name = remainder.strip().strip("/")
         ns_name = ns_name.split("/")
         ns_name = [seg for seg in ns_name if seg and seg.strip()]
-        namespace = ""
         name = ""
-        if len(ns_name) > 1:
+        if not namespace and len(ns_name) > 1:
             name = ns_name[-1]
             ns = ns_name[0:-1]
             namespace = "/".join(ns)

tests/data/test-suite-data.json

@@ -298,5 +298,53 @@
     "qualifiers": {"in production": "true"},
     "subpath": null,
     "is_invalid": true
+  },
+  {
+    "description": "valid npm purl without version and with subpath",
+    "purl": "pkg:npm/@babel/core#/googleapis/api/annotations/",
+    "canonical_purl": "pkg:npm/%40babel/core#googleapis/api/annotations",
+    "type": "npm",
+    "namespace": "@babel",
+    "name": "core",
+    "version": null,
+    "qualifiers": null,
+    "subpath": "googleapis/api/annotations",
+    "is_invalid": false
+  },
+  {
+    "description": "valid npm purl with namespace, version and subpath",
+    "purl": "pkg:npm/@babel/core@1.0.2#/googleapis/api/annotations/",
+    "canonical_purl": "pkg:npm/%40babel/core@1.0.2#googleapis/api/annotations",
+    "type": "npm",
+    "namespace": "@babel",
+    "name": "core",
+    "version": "1.0.2",
+    "qualifiers": null,
+    "subpath": "googleapis/api/annotations",
+    "is_invalid": false
+  },
+  {
+    "description": "valid npm purl without namespace and with subpath",
+    "purl": "pkg:npm/core@1.0.2#/googleapis/api/annotations/",
+    "canonical_purl": "pkg:npm/core@1.0.2#googleapis/api/annotations",
+    "type": "npm",
+    "namespace": null,
+    "name": "core",
+    "version": "1.0.2",
+    "qualifiers": null,
+    "subpath": "googleapis/api/annotations",
+    "is_invalid": false
+  },
+  {
+    "description": "valid npm purl without namespace, version and subpath",
+    "purl": "pkg:npm/core#/googleapis/api/annotations/",
+    "canonical_purl": "pkg:npm/core#googleapis/api/annotations",
+    "type": "npm",
+    "namespace": null,
+    "name": "core",
+    "version": null,
+    "qualifiers": null,
+    "subpath": "googleapis/api/annotations",
+    "is_invalid": false
   }
 ]