quarkusio/quarkus · error · java.lang.IllegalArgumentException

Invalid PURL:

Error message

Invalid PURL: 

What it means

Purl.parse() validates a package URL (purl) string against the PURL_PATTERN regex and throws IllegalArgumentException 'Invalid PURL: <str>' when it does not match the purl spec structure pkg:<type>/<namespace>/<name>@<version>?<qualifiers>#<subpath>.

Source

Thrown at independent-projects/bootstrap/app-model/src/main/java/io/quarkus/sbom/Purl.java:118

        return new Purl(type, namespace, name, version, Collections.emptyMap(), null);
    }

    public static Builder builder() {
        return new Builder();
    }

    /**
     * Parses a canonical PURL string.
     *
     * @param purlString a PURL string starting with "pkg:"
     * @return the parsed Purl
     * @throws IllegalArgumentException if the string is not a valid PURL
     */
    public static Purl parse(String purlString) {
        Objects.requireNonNull(purlString, "purlString is null");
        Matcher m = PURL_PATTERN.matcher(purlString);
        if (!m.matches()) {
            throw new IllegalArgumentException("Invalid PURL: " + purlString);
        }

        String type = m.group(1);
        String namespaceName = m.group(2);
        String versionRaw = m.group(3);
        String qualifiersRaw = m.group(4);
        String subpathRaw = m.group(5);

        String namespace = null;
        String name;
        int lastSlashIdx = namespaceName.lastIndexOf('/');
        if (lastSlashIdx < 0) {
            name = percentDecode(namespaceName);
        } else {
            name = percentDecode(namespaceName.substring(lastSlashIdx + 1));
            namespace = decodePath(namespaceName.substring(0, lastSlashIdx));
        }

View on GitHub (pinned to e1c734241f)

Solutions

1. Fix the purl string to the canonical form: pkg:type/namespace/name@version?qualifiers#subpath (e.g. pkg:maven/io.quarkus/quarkus-core@3.0.0)
2. Validate the string with the purl spec grammar before parsing
3. If it came from another tool, regenerate the SBOM/purl with a spec-compliant generator

Example fix

// before
Purl.parse("maven:io.quarkus:quarkus-core:3.0.0");
// after
Purl.parse("pkg:maven/io.quarkus/quarkus-core@3.0.0");

if (s == null || !s.startsWith("pkg:")) { throw new IllegalArgumentException("Not a purl: " + s); }
Purl.parse(s);

boolean looksLikePurl(String s) { return s != null && s.startsWith("pkg:") && java.util.regex.Pattern.matches("^pkg:[a-zA-Z0-9._-]+/[^/]+/[^/@?#]+(@[^?#]*)?(\\?.*)?(#.*)?$", s); }

try { Purl.parse(purlString); } catch (IllegalArgumentException e) { log.warn("Skipping invalid purl: " + purlString); }

When it happens

Trigger: Calling Purl.parse(purlString) with a string lacking the 'pkg:' scheme, empty type/name, illegal characters, or otherwise not conforming to the purl grammar.

Common situations: SBOM tooling receiving hand-written or third-party purl strings; migrated SBOM data from other tools with non-canonical purls; typos like 'pkg:maven/quarkus' (missing coordinates).

Related errors

• Invalid PURL qualifier
• type must not be empty
• name must not be empty
• Maven PURL is missing a namespace (groupId) for name (artifa
• PURL type must start with a letter:

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/1a2dc60e14e96bab. Report an issue: GitHub.