Synchronise 2025.1 with upstream

.pre-commit-config.yaml

@@ -42,7 +42,13 @@ repos:
     hooks:
       - id: hacking
         additional_dependencies: []
-        exclude: '^(doc|releasenotes|tools)/.*$'
+        exclude: |
+          (?x)^(
+           doc|
+           releasenotes|
+           tools|
+           ironic/common/kernel_parameter_parser
+          )/.*$
   - repo: https://github.com/codespell-project/codespell
     rev: v2.2.6
     hooks:
@@ -85,6 +91,7 @@ repos:
     hooks:
       - id: ruff
         args: ['--fix', '--unsafe-fixes']
+        exclude: '^ironic/common/kernel_parameter_parser/.*$'
   - repo: local
     hooks:
       - id: check-releasenotes

LICENSE

@@ -174,3 +174,5 @@
       incurred by, or claims asserted against, such Contributor by reason
       of your accepting any such warranty or additional liability.
 
+ironic/common/kernel_parameter_parser/kernel_parameter_parser.py is governed
+by the MPL v2.0 license. See that file for more information.

ironic/common/exception.py

@@ -1140,3 +1140,9 @@ class RuleActionExecutionFailure(InspectionRuleExecutionFailure):
 class RuleConditionCheckFailure(InspectionRuleExecutionFailure):
     """Raised when an inspection rule condition fails during execution."""
     _msg_fmt = _("Inspection rule condition check failed. Reason: %(reason)s")
+
+
+class InvalidContent(Invalid):
+    """Invalid or malicious content has been provided to the conductor."""
+    _msg_fmt = _("Invalid or potentially malicious content has been provided "
+                 "to the conductor and the conductor will not proceed.")

ironic/common/images.py

@@ -828,15 +828,22 @@ def _extract_iso(extract_iso, extract_dir):
     iso.open(extract_iso)
 
     for dirname, dirlist, filelist in iso.walk(iso_path='/'):
+        # NOTE(TheJulia): This code is confusing because the way the
+        # walk method returns data, basically a list of tuples to
+        # provide a structural mapping which a consumer of the walk
+        # data can use to understand the structure.
         dir_path = dirname.lstrip('/')
+        utils.check_iso_path(extract_dir, dir_path)
         for dir_iso in dirlist:
+            utils.check_iso_path(extract_dir,
+                                 os.path.join(dir_path, dir_iso))
             os.makedirs(os.path.join(extract_dir, dir_path, dir_iso))
         for file in filelist:
-            file_path = os.path.join(extract_dir, dirname, file)
+            utils.check_iso_path(extract_dir, dir_path, file)
+            file_path = os.path.join(dirname, file)
             iso.get_file_from_iso(
                 os.path.join(extract_dir, dir_path, file),
                 iso_path=file_path)
-
     iso.close()
 
 

ironic/common/kernel_parameter_parser/grammar.g

@@ -0,0 +1,44 @@
+// NOTE(clif): This grammar is used by lark to generate the parser found in
+// kernel_parameter_parser.py
+//
+// The following assumes your current working directory is the same as this
+// grammar file and the lark python library is available. Check the existing
+// generated parser to find the lark
+// version used.
+//
+// Use this command to regenerate the parser:
+//
+// $ python -m lark.tools.standalone grammar.g > kernel_parameter_parser.py
+//
+// The generated file (kernel_parameter_parser.py) will note at the beginning
+// of the file which version of lark was used to generate it. Additionally
+// note that lark requires python >= 3.8. Which means the stand-alone parser
+// *should* be fine for any recent-ish version of Ironic.
+//
+// NOTE(clif): The generated parser has some calls to pickle which trip
+// Bandit's B301 test. If you regenerate the parser you will need to mark
+// Those lines as # noqa B301
+// If for some reason we do end up using lark's cache or save/load()
+// functionality then we'll have to revisit this decision.
+
+?start: kernel_command_line
+
+kernel_command_line: parameter_list
+
+parameter_list: parameter?(" "+ parameter)*
+
+parameter: key
+         | key_value_pair
+
+key_value_pair: key"="value
+
+key: /[A-Za-z0-9_\-\.]+/
+
+value: bare_value
+     | quoted_value
+
+quoted_value: "\"" value_with_spaces "\""
+
+bare_value: /[\!\#-\\.0-9:-\@A-Za-z\[-~]+/
+
+value_with_spaces: /[\!\#-\\.0-9:-\@A-Za-z\[-~ ]+/