A package name Packagist would accept, so a hostile value cannot be smuggled into the URL.
Refusing rather than encoding: a name that needs escaping is not a package name, and building a URL
from unvalidated input is how a path traversal reaches a metadata host.
A package name Packagist would accept, so a hostile value cannot be smuggled into the URL.
Refusing rather than encoding: a name that needs escaping is not a package name, and building a URL from unvalidated input is how a path traversal reaches a metadata host.