Windows sbom have strange % in purl/sbom-ref

[freeeflyer]

What happened:
I tried to generate a sbom with syft on a windows system.
To avoid intrusion on a working unconnecter system

• I booted a linux stick on said system,
• mounted windows disk on /mnt
• launched syft like that

syft scan dir:/mnt -o cyclonedx=sbom.json

I tried to import said sbom on dependency track got an error :

Caused by: org.datanucleus.exceptions.NucleusUserException: Attempt to store value "pkg:nuget/Microsoft%20Reporting%20Services%20%FFFFFFC3%FFFFFF92%FFFFFFC2%FFFFFF9B%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF8B%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB7%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFBC%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF82%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF82%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF80%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%20%FFFFFFC3%FFFFFF92%FFFFFFC2%FFFFFFAF%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF88%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFBD%20ADO.NET%20%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB4%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF80%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFBA%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF82%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF80%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFBD%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFF92%FFFFFFC2%FFFFFFA3%20%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB6%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB5%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF82%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFBA%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFF90%FFFFFFC2%FFFFFFB7%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF83%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF88%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF81%FFFFFFC3%FFFFFF91%FFFFFFC2%FFFFFF96%FFFFFFC3%FFFFFFAF%FFFFFFC2%FFFFFFBF%FFFFFFC2%FFFFFFBD@11.0.9165.1186" in column "PURLCOORDINATES" that has maximum length of 786. Please correct your data!

I searched that string in the json file -> nothing
But some of the the sbom-ref or purl fields were strange:

bom-ref": "pkg:nuget/Microsoft%20Reporting%20Services%20%D0%BF%D1%80%D0%BE%D1%88%D0%B8%D1%80%D0%B5%D1%9A%D0%B5%20%D0%BF%D0%BE%D0%B4%D0%B0%D1%82%D0%B0%D0%BA%D0%B0%20%D0%B7%D0%B0%20Analysis%20Services@11.0.9165.1186?package-id=9ddc785f7a23aa1b",

What you expected to happen:
Get readable & short fields

Anything else we need to know?:
It seems to be urlencoded: I found that "pkg:nuget/Microsoft%20Reporting%20Services%20%D0%BF%D1%80%D0%BE%D1%88%D0%B8%D1%80%D0%B5%D1%9A%D0%B5%20%D0%BF%D0%BE%D0%B4%D0%B0%D1%82%D0%B0%D0%BA%D0%B0%20%D0%B7%D0%B0%20Analysis%20Services@11.0.9165.1186" decodes as "pkg:nuget/Microsoft Reporting Services проширење података за Analysis Services@11.0.9165.1186"

Environment:

• Output of syft version: 1.18.1
• OS (e.g: cat /etc/os-release or similar): ubuntu 24 on the stick, windows 10 ltsc on the system

[kzantow]

Hey @freeeflyer -- thanks for the report. Is there a way to reproduce this using a container image, source code, or something that doesn't involve booting a Windows machine with an alternate boot loader?

[freeeflyer]

Hey @freeeflyer -- thanks for the report. Is there a way to reproduce this using a container image, source code, or something that doesn't involve booting a Windows machine with an alternate boot loader?

• I could generate a tiny sbom with the issue
• Or maybe I could point you to the dll/exe generating the issue ?
  (I don't think I can upload a licenced binary here..)

[kzantow]

Pointing to the DLL/exe would be great, if there's a publicly available one we could download 👍