fixing July reported secvulns

plugins/httpapi/panos.py

@@ -584,11 +584,6 @@ def send_request(
             }
         )
 
-        display.vvvv("send_request(): headers = {0}".format(headers))
-        display.vvvv("send_request(): method = {0}".format(method))
-        display.vvvv("send_request(): path = {0}".format(path))
-        display.vvvv("send_request(): data = {0}".format(data))
-
         try:
             response, response_data = self.connection.send(
                 path, data, method=method, headers=headers

plugins/modules/panos_import.py

@@ -131,6 +131,12 @@
             - URL of the file that will be imported to device.
         type: str
         required: false
+    verify:
+        description:
+            - If true, validates SSL certificates when importing files.
+        type: bool
+        required: false
+        default: false
 """
 
 EXAMPLES = """
@@ -212,13 +218,17 @@
     HAS_LIB = False
 
 
-def import_file(module, xapi, filename, params):
+def import_file(module, xapi, filename, params, verify=False):
     params.update({"type": "import", "key": xapi.api_key})
 
     url = "https://{0}:{1}/api".format(xapi.hostname, xapi.port)
     files = {"file": open(filename, "rb")}
 
-    r = requests.post(url, params=params, files=files, verify=False)
+    try:
+        r = requests.post(url, params=params, files=files, verify=verify)
+    except requests.exceptions.SSLError:
+        module.fail_json(msg="SSL Verification failed, and 'verify' set to true.")
+
     response = xml.etree.ElementTree.fromstring(r.content)
 
     if r.status_code != 200 or response.attrib["status"] == "error":
@@ -305,6 +315,7 @@ def main():
             profile_name=dict(type="str"),
             filename=dict(type="str", aliases=["file"]),
             url=dict(),
+            verify=dict(type="bool", default=False),
         ),
     )
     module = AnsibleModule(
@@ -362,9 +373,11 @@ def main():
     elif module.params["template"] is not None:
         params["target-tpl"] = module.params["template"]
 
+    verify = module.params.get("verify", False)
+
     try:
         if not module.check_mode:
-            import_file(module, xapi, filename, params)
+            import_file(module, xapi, filename, params, verify=verify)
         changed = True
 
     except Exception as e:

plugins/modules/panos_loadcfg.py

@@ -78,6 +78,7 @@
 """
 
 from ansible.module_utils.basic import AnsibleModule
+from xml.sax.saxutils import escape
 
 try:
     import pan.xapi
@@ -89,7 +90,7 @@
 
 def load_cfgfile(xapi, module, ip_address, file_):
     # load configuration file
-    cmd = "<load><config><from>%s</from></config></load>" % file_
+    cmd = "<load><config><from>%s</from></config></load>" % escape(file_)
 
     xapi.op(cmd=cmd)
 

pyproject.toml

@@ -16,7 +16,7 @@ package-mode = false
 # Best compatible way is to use >= and < version range contraints.
 [tool.poetry.dependencies]
 python = ">=3.10,<4.0"
-pan-os-python = ">=1.13.0,<2.0"
+pan-os-python = ">=1.13.1,<2.0"
 xmltodict = ">=0.12.0"
 aiohttp = ">=3.8.4"
 dpath = ">=2.1.5"

requirements.txt

@@ -1,5 +1,5 @@
 aiohttp>=3.8.4 ; python_version >= "3.10" and python_version < "4.0"
 dpath>=2.1.5 ; python_version >= "3.10" and python_version < "4.0"
-pan-os-python>=1.13.0,<2.0 ; python_version >= "3.10" and python_version < "4.0"
+pan-os-python>=1.13.1,<2.0 ; python_version >= "3.10" and python_version < "4.0"
 panos-upgrade-assurance>=2.0.0,<3.0 ; python_version >= "3.10" and python_version < "4.0"
 xmltodict>=0.12.0 ; python_version >= "3.10" and python_version < "4.0"