Incorrect URL encoded coordinates in REST response

[missingdays]

Hi!
I've noticed that requesting coordinates containing "+" symbol in version, e.g. pkg:maven/org.antlr/antlr4@4.+ results in incorrectly encoded coordinates in response - "coordinates": "pkg:maven/org.antlr/antlr4@4.%20. This breaks matching request and response by coordinates.

[voronaam]

According to the spec 1 "a purl is a URL" and conforms to the RFC.

As such, you would need to encode + as %2B - much like any time you would want to do that with an URL.

And "pkg:maven/org.antlr/antlr4@4.%2B" comes through properly, as far as I could tell.

[missingdays]

According to URL specification, + sign is not a special character and can be used without encoding it. See https://tools.ietf.org/html/rfc1738, specifically part 5, BNF for specific URL schemes.

The problem in question is that the + sign is that it's encoded as %20 which is an encoding for a sign (a space) and not for a + sign. This error probably comes from using URLEncoder.encode, which is not URL specification compliant, see https://bugs.openjdk.java.net/browse/JDK-8179507