Add extra validation to qualifiers

pombredanne · pombredanne · commit 1723c4909b5b · 2018-11-06T12:47:36.000-08:00
Signed-off-by: Philippe Ombredanne &lt;pombredanne@nexb.com&gt;
diff --git a/src/packageurl.py b/src/packageurl.py
@@ -165,6 +165,10 @@ def normalize_qualifiers(qualifiers, encode=True):  # NOQA
             qualifiers = qualifiers.decode('utf-8')
         # decode string to list of tuples
         qualifiers = qualifiers.split('&')
+        if not all('=' in kv for kv in qualifiers):
+            raise ValueError(
+                'Invalid qualifier. '
+                'Must be a string of key=value pairs:{}'.format(repr(qualifiers)))
         qualifiers = [kv.partition('=') for kv in qualifiers]
         qualifiers = [(k, v) for k, _, v in qualifiers]
     elif isinstance(qualifiers, dict):
diff --git a/test_purl.py b/test_purl.py
@@ -199,7 +199,6 @@ def test_create_PackageURL_from_qualifiers_dict(self):
             subpath)
         assert canonical_purl == purl.to_string()
 
-
     def test_normalize_encode_can_take_unicode_with_non_ascii_with_slash(self):
         uncd = u'núcleo/núcleo'
         normal = normalize(
@@ -244,3 +243,11 @@ def test_normalize_encode_always_reencodes(self):
             u'n%25c3%25bacleo/n%25c3%25bacleo'
         )
         assert expected == normal
+
+    def test_qualifiers_must_be_key_value_pairs(self):
+        purl = 'pkg:maven/org.apache.xmlgraphics/batik-anim@1.9.1?this+is+not+a+key_value'
+        try:
+            PackageURL.from_string(purl)
+            self.fail('Failed to raise exception for invalid qualifiers')
+        except ValueError as ve:
+            assert 'Invalid qualifier. Must be a string of key=value pairs' in str(ve)
