Merge branch 'fix/install_input_validation_v5.0' into 'release/v5.0'

fix(idf_tools): Validate input features (v5.0)

See merge request espressif/esp-idf!37893

tools/idf_tools.py

@@ -1386,14 +1386,24 @@ def feature_to_requirements_path(feature):  # type: (str) -> str
 def process_and_check_features(idf_env_obj, features_str):  # type: (IDFEnv, str) -> list[str]
     new_features = []
     remove_features = []
-    for new_feature_candidate in features_str.split(','):
+    invalid_features = []
+
+    for new_feature_candidate in [feature for feature in features_str.split(',') if feature != '']:
+        # Feature to be added/removed needs to be checked if valid
+        sanitized_feat = new_feature_candidate.lstrip('-+')
+        if not os.path.isfile(feature_to_requirements_path(sanitized_feat)):
+            invalid_features += [sanitized_feat]
+            continue
+
         if new_feature_candidate.startswith('-'):
             remove_features += [new_feature_candidate.lstrip('-')]
         else:
-            new_feature_candidate = new_feature_candidate.lstrip('+')
-            # Feature to be added needs to be checked if is valid
-            if os.path.isfile(feature_to_requirements_path(new_feature_candidate)):
-                new_features += [new_feature_candidate]
+            new_features += [new_feature_candidate.lstrip('+')]
+
+    if invalid_features:
+        fatal(f'The following selected features are not valid: {", ".join(invalid_features)}')
+        raise SystemExit(1)
+
     idf_env_obj.get_active_idf_record().update_features(tuple(new_features), tuple(remove_features))
     return idf_env_obj.get_active_idf_record().features
 

tools/install_util.py

@@ -1,31 +1,31 @@
 #!/usr/bin/env python
-
-# SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+# SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
 #
 # SPDX-License-Identifier: Apache-2.0
-
 # This script is used from the $IDF_PATH/install.* scripts. This way the argument parsing can be done at one place and
 # doesn't have to be implemented for all shells.
-
 import argparse
 from itertools import chain
 
 
 def action_extract_features(args: str) -> None:
     """
-    Command line arguments starting with "--enable-" or "--disable" are features. This function selects those, add them signs '+' or '-' and prints them.
+    Command line arguments starting with "--enable-" or "--disable-" are features.
+    This function selects those, adds them a '+' or '-' sign and prints them.
     """
     features = ['+core']  # "core" features should be always installed
 
     if args:
         arg_enable_prefix = '--enable-'
         arg_disable_prefix = '--disable-'
-        # features to be enabled has prefix '+', disabled has prefix '-'
+        # features to be enabled have prefix '+', disabled have prefix '-'
         for arg in args.split():
             if arg.startswith(arg_enable_prefix):
                 features.append('+' + arg[len(arg_enable_prefix):])
             elif arg.startswith(arg_disable_prefix):
                 features.append('-' + arg[len(arg_disable_prefix):])
+            elif arg.startswith('-'):
+                raise SystemExit(f'ERROR: Invalid feature specifier: {arg}')
         features = list(set(features))
 
     print(','.join(features))