rapid7/metasploit-framework — pull request #1417 by wchen-r7 (2013-01-31 07:33:38+00:00)
Title: Improves normalize_uri(), and updates modules that are using it

Related to [SeeRM #7733]:
http://dev.metasploit.com/redmine/issues/7733

This pull request focuses on two main things: Changing the normalize_uri() function, and modules that use it.

normalize_uri() Function:

Long story short, our current normalize_uri() will remove the trailing slash when sometimes it shouldn't be doing that. This is because "/abc/" can give you a 200 (index page or directory), while a "/abc" can give you a 301. So this update gets rid of that code.

The new normalize_uri() also supports a new writing style that's similar to File.join(). For example, now you can do this:

normalize_uri("test", "test.html") # Returns "/test/test.html"
normalize_uri("test/", "test/") # Returns "/test/test/"
normalize_uri("test//", "test") # Returns "/test/test"

This way, the module no longer has to worry about if there's an extra "/", or a missing "/". You can just join the paths together like the above writing style, and normalize_uri() will take care of the rest.

Modules:

For best results, modules should run normalize_uri() before a send_request_* call. If you do a normalize_uri() first, but then you concatenate more paths, the URI is no longer normalized -- and if that's the case, you may get the double-slash bug again. Some modules didn't implement it correctly, so I had to go back and check them all.