fix: encode double-quot in URL

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
CycloneDX · Oct 24, 2024 · 4322faa · 4322faa
1 parent 8fe2b4a
commit 4322faa
Show file tree

Hide file tree

Showing 13 changed files with 13 additions and 12 deletions.
diff --git a/cyclonedx/model/__init__.py b/cyclonedx/model/__init__.py
@@ -689,6 +689,7 @@ class XsUri(serializable.helpers.BaseHelper):
 
     __SPEC_REPLACEMENTS = (
         (' ', '%20'),
+        ('"', '%22'),
         ('[', '%5B'),
         (']', '%5D'),
         ('<', '%3C'),

diff --git a/tests/_data/models.py b/tests/_data/models.py
@@ -1213,7 +1213,7 @@ def get_bom_for_issue_497_urls() -> Bom:
             ExternalReference(
                 type=ExternalReferenceType.OTHER,
                 comment='control characters',
-                url=XsUri('https://acme.org/?foo=sp ace&bar[23]=42&lt=1<2&gt=3>2&cb={lol}')
+                url=XsUri('https://acme.org/?foo=sp ace&bar[23]=42&lt=1<2&gt=3>2&cb={lol}&dq=a"test"')
             ),
             ExternalReference(
                 type=ExternalReferenceType.OTHER,

diff --git a/tests/_data/snapshots/get_bom_for_issue_497_urls-1.1.xml.bin b/tests/_data/snapshots/get_bom_for_issue_497_urls-1.1.xml.bin
@@ -14,7 +14,7 @@
           <comment>pre-encoded</comment>
         </reference>
         <reference type="other">
-          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D</url>
+          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D&amp;dq=a%22test%22</url>
           <comment>control characters</comment>
         </reference>
       </externalReferences>

diff --git a/tests/_data/snapshots/get_bom_for_issue_497_urls-1.2.json.bin b/tests/_data/snapshots/get_bom_for_issue_497_urls-1.2.json.bin
@@ -16,7 +16,7 @@
         {
           "comment": "control characters",
           "type": "other",
-          "url": "https://acme.org/?foo=sp%20ace&bar%5B23%5D=42&lt=1%3C2&gt=3%3E2&cb=%7Blol%7D"
+          "url": "https://acme.org/?foo=sp%20ace&bar%5B23%5D=42&lt=1%3C2&gt=3%3E2&cb=%7Blol%7D&dq=a%22test%22"
         }
       ],
       "name": "dummy",

diff --git a/tests/_data/snapshots/get_bom_for_issue_497_urls-1.2.xml.bin b/tests/_data/snapshots/get_bom_for_issue_497_urls-1.2.xml.bin
@@ -17,7 +17,7 @@
           <comment>pre-encoded</comment>
         </reference>
         <reference type="other">
-          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D</url>
+          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D&amp;dq=a%22test%22</url>
           <comment>control characters</comment>
         </reference>
       </externalReferences>

diff --git a/tests/_data/snapshots/get_bom_for_issue_497_urls-1.3.json.bin b/tests/_data/snapshots/get_bom_for_issue_497_urls-1.3.json.bin
@@ -16,7 +16,7 @@
         {
           "comment": "control characters",
           "type": "other",
-          "url": "https://acme.org/?foo=sp%20ace&bar%5B23%5D=42&lt=1%3C2&gt=3%3E2&cb=%7Blol%7D"
+          "url": "https://acme.org/?foo=sp%20ace&bar%5B23%5D=42&lt=1%3C2&gt=3%3E2&cb=%7Blol%7D&dq=a%22test%22"
         }
       ],
       "name": "dummy",

diff --git a/tests/_data/snapshots/get_bom_for_issue_497_urls-1.3.xml.bin b/tests/_data/snapshots/get_bom_for_issue_497_urls-1.3.xml.bin
@@ -17,7 +17,7 @@
           <comment>pre-encoded</comment>
         </reference>
         <reference type="other">
-          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D</url>
+          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D&amp;dq=a%22test%22</url>
           <comment>control characters</comment>
         </reference>
       </externalReferences>

diff --git a/tests/_data/snapshots/get_bom_for_issue_497_urls-1.4.json.bin b/tests/_data/snapshots/get_bom_for_issue_497_urls-1.4.json.bin
@@ -16,7 +16,7 @@
         {
           "comment": "control characters",
           "type": "other",
-          "url": "https://acme.org/?foo=sp%20ace&bar%5B23%5D=42&lt=1%3C2&gt=3%3E2&cb=%7Blol%7D"
+          "url": "https://acme.org/?foo=sp%20ace&bar%5B23%5D=42&lt=1%3C2&gt=3%3E2&cb=%7Blol%7D&dq=a%22test%22"
         }
       ],
       "name": "dummy",

diff --git a/tests/_data/snapshots/get_bom_for_issue_497_urls-1.4.xml.bin b/tests/_data/snapshots/get_bom_for_issue_497_urls-1.4.xml.bin
@@ -16,7 +16,7 @@
           <comment>pre-encoded</comment>
         </reference>
         <reference type="other">
-          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D</url>
+          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D&amp;dq=a%22test%22</url>
           <comment>control characters</comment>
         </reference>
       </externalReferences>

diff --git a/tests/_data/snapshots/get_bom_for_issue_497_urls-1.5.json.bin b/tests/_data/snapshots/get_bom_for_issue_497_urls-1.5.json.bin
@@ -16,7 +16,7 @@
         {
           "comment": "control characters",
           "type": "other",
-          "url": "https://acme.org/?foo=sp%20ace&bar%5B23%5D=42&lt=1%3C2&gt=3%3E2&cb=%7Blol%7D"
+          "url": "https://acme.org/?foo=sp%20ace&bar%5B23%5D=42&lt=1%3C2&gt=3%3E2&cb=%7Blol%7D&dq=a%22test%22"
         }
       ],
       "name": "dummy",

diff --git a/tests/_data/snapshots/get_bom_for_issue_497_urls-1.5.xml.bin b/tests/_data/snapshots/get_bom_for_issue_497_urls-1.5.xml.bin
@@ -16,7 +16,7 @@
           <comment>pre-encoded</comment>
         </reference>
         <reference type="other">
-          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D</url>
+          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D&amp;dq=a%22test%22</url>
           <comment>control characters</comment>
         </reference>
       </externalReferences>

diff --git a/tests/_data/snapshots/get_bom_for_issue_497_urls-1.6.json.bin b/tests/_data/snapshots/get_bom_for_issue_497_urls-1.6.json.bin
@@ -16,7 +16,7 @@
         {
           "comment": "control characters",
           "type": "other",
-          "url": "https://acme.org/?foo=sp%20ace&bar%5B23%5D=42&lt=1%3C2&gt=3%3E2&cb=%7Blol%7D"
+          "url": "https://acme.org/?foo=sp%20ace&bar%5B23%5D=42&lt=1%3C2&gt=3%3E2&cb=%7Blol%7D&dq=a%22test%22"
         }
       ],
       "name": "dummy",

diff --git a/tests/_data/snapshots/get_bom_for_issue_497_urls-1.6.xml.bin b/tests/_data/snapshots/get_bom_for_issue_497_urls-1.6.xml.bin
@@ -16,7 +16,7 @@
           <comment>pre-encoded</comment>
         </reference>
         <reference type="other">
-          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D</url>
+          <url>https://acme.org/?foo=sp%20ace&amp;bar%5B23%5D=42&amp;lt=1%3C2&amp;gt=3%3E2&amp;cb=%7Blol%7D&amp;dq=a%22test%22</url>
           <comment>control characters</comment>
         </reference>
       </externalReferences>