rapid7/metasploit-framework — pull request #3979 by wchen-r7 (2014-10-09 18:53:08+00:00)
Title: Fix #3976 - validate and normalize user-supplied URI for http_login.rb

This fixes https://github.com/rapid7/metasploit-framework/issues/3976

URI should be validated and normalized before being used in an HTTP request.

## Recommended verification steps

- [ ] Set up an HTTP server with basic authentication. I can't be very specific here on how you can set it up, but basically you can pick your favorite server, google for instructions.
- [ ] Make sure your auth path is one of these: /, /admin/, /manager/, /Management.asp
- [ ] Start ```msfconsole```
- [ ] ```set username [valid username]```
- [ ] ```set password [valid password]```
- [ ] ```set rhosts [IP]```
- [ ] ```set stop_on_success true```, but you don't have to if you don't mind the noises.
- [ ] Make sure you DO NOT set the AUTH_URI option, because when it's not set it will try its own default paths.
- [ ] Do ```run```, you should be able to a successful login
- [ ] Now, ```set AUTH_URI %```
- [ ] ```run``` again. This time, it should say "[-] Invalid URI: %", and then no login attempts
- [ ] Finally, ```set AUTH_URI [valid auth path]```
- [ ] It should tell you the login is successful again