.NET / nuget - invalid SBOM generated after parsing

[kmoens]

What happened:
When using Syft to generate the SBOM for one of our Docker Images we encountered issues uploading the generated SBOM towards Dependency Track due to an invalid Package URL that was created.

Hereby the fragment of the SBOM:

    {
      "bom-ref": "pkg:nuget/%C3%A4b\u0001FileVersion@4.6.25512.01%20built%20by:%20dlab-DDVSOWINAGE016.%20Commit%20Hash:%20d0d5c7b49271cadb6d97de26d8e623e98abdc8db?package-id=3ddefa9d1305fed5",
      "type": "library",
      "name": "äb\u0001FileVersion",
      "version": "4.6.25512.01 built by: dlab-DDVSOWINAGE016. Commit Hash: d0d5c7b49271cadb6d97de26d8e623e98abdc8db",
      "purl": "pkg:nuget/%C3%A4b\u0001FileVersion@4.6.25512.01%20built%20by:%20dlab-DDVSOWINAGE016.%20Commit%20Hash:%20d0d5c7b49271cadb6d97de26d8e623e98abdc8db",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "dotnet-portable-executable-cataloger"
        },
        {
          "name": "syft:package:metadataType",
          "value": "DotnetPortableExecutableMetadata"
        },
        {
          "name": "syft:package:type",
          "value": "dotnet"
        },
        {
          "name": "syft:location:0:layerID",
          "value": "sha256:d3093f2eddfbe245a9e15bb6245e82ab28499636b9052f643b2d53a89001cadb"
        },
        {
          "name": "syft:location:0:path",
          "value": "/app/runtimes/win-x64/native/sni.dll"
        }
      ]
    },

This resulted in an error while parsing the SBOM as follows:

[2023-10-24 16:27:06.862]  malformed package url pkg:nuget/%C3%A4b�FileVersion@4.6.25512.01%20built%20by:%20dlab-DDVSOWINAGE016.%20Commit%20Hash:%20d0d5c7b49271cadb6d97de26d8e623e98abdc8db
[2023-10-24 16:27:06.863]  com.github.packageurl.MalformedPackageURLException: Invalid purl: Illegal character in opaque part at index 17: pkg:nuget/%C3%A4b�FileVersion@4.6.25512.01%20built%20by:%20dlab-DDVSOWINAGE016.%20Commit%20Hash:%20d0d5c7b49271cadb6d97de26d8e623e98abdc8db
[2023-10-24 16:27:06.863]  	at com.github.packageurl.PackageURL.parse(PackageURL.java:549)
[2023-10-24 16:27:06.863]  	at com.github.packageurl.PackageURL.<init>(PackageURL.java:68)

Which is obvious, since it is effectively an invalid SBOM.

What you expected to happen:
A correct and parseable SBOM is created.

Steps to reproduce the issue:
You can use the DLL in question at https://github.com/kmoens/syft-bug-dll/blob/main/sni.dll.gz

Environment:

• Output of syft version: 0.94.0
• OS (e.g: cat /etc/os-release or similar): Ubuntu 22.04

[spiffcs]

Thanks for the report @kmoens - This could also potentially be related to #2241