Make path traversal containment check case-insensitive

[bitterpanda63]

Makes the user-input containment check in path traversal detection case-insensitive, matching the fix applied to the Node.js firewall in AikidoSec/firewall-node#1047.

Problem: On case-insensitive filesystems (macOS APFS, Windows NTFS), an attacker can submit a path like /ETC/PASSWD which resolves to /etc/passwd. The detection check filePath.contains(userInput) was case-sensitive, so /ETC/PASSWD would not be found in /etc/passwd and traversal would go undetected.

Fix: Changed filePath.contains(userInput) to filePath.toLowerCase().contains(userInput.toLowerCase()). Note that startsWithUnsafePath already lowercases both sides before comparing, so no change was needed there.

See: AikidoSec/firewall-node#1047

Summary by Aikido

Security Issues: 0	Quality Issues: 0	Resolved Issues: 0

🐛 Bugfixes

• Made path containment check case-insensitive to fix traversal detection

^{More info}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!