pUrl parsing causing crash when locator has invalid value

[CrossedSecurity]

This bug is probably somewhere in github.com/package-url/packageurl-go@v0.1.1-0.20220428063043-89078438f170/packageurl.go

When a Spdx doc contains a package with an external ref that has a locator of literally "pkg:type/namespace/name@version?qualifiers#subpath" , the program will crash.

input:

...
      {
         "SPDXID":"SPDXRef-Package--",
         "name":"",
         "filesAnalyzed":false,
         "licenseDeclared":"NOASSERTION",
         "licenseConcluded":"NOASSERTION",
         "downloadLocation":"https://",
         "copyrightText":"NOASSERTION",
         "externalRefs":[
            {
               "referenceCategory":"PACKAGE_MANAGER",
               "referenceLocator":"pkg:type/namespace/name@version?qualifiers#subpath",
               "referenceType":"purl"
            }
         ]
      }
...

output:

panic: runtime error: index out of range [1] with length 1 [recovered]
        panic: runtime error: index out of range [1] with length 1

[lumjjb]

hmm... there isn't github.com/package-url/packageurl-go in use in this package, so it looks like we have no control over that code that does the panic..

However, we do have control over validation of the PURLs though, which should be done as part of #194

If this is the case, i think we can close this issue with that mention towards #194

[lumjjb]

Closing this since it seems like it is not caused by issue in library.