diff --git a/agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/path_traversal/PathTraversalDetector.java b/agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/path_traversal/PathTraversalDetector.java index 5103b45b..acf1abf9 100644 --- a/agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/path_traversal/PathTraversalDetector.java +++ b/agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/path_traversal/PathTraversalDetector.java @@ -30,7 +30,7 @@ public DetectorResult run(String userInput, String[] arguments) { // Ignore cases where the user input is longer than the file path. return new DetectorResult(); } - if (!filePath.contains(userInput)) { + if (!filePath.toLowerCase().contains(userInput.toLowerCase())) { // Ignore cases where the user input is not part of the file path. return new DetectorResult(); } diff --git a/agent_api/src/test/java/vulnerabilities/path_traversal/PathTraversalDetectorTest.java b/agent_api/src/test/java/vulnerabilities/path_traversal/PathTraversalDetectorTest.java index 514a019f..b8931c57 100644 --- a/agent_api/src/test/java/vulnerabilities/path_traversal/PathTraversalDetectorTest.java +++ b/agent_api/src/test/java/vulnerabilities/path_traversal/PathTraversalDetectorTest.java @@ -210,4 +210,11 @@ public void testUserInputWithEmptyFilePath() { public void testUserInputWithFilePathContainingSpaces() { assertNotAttack(PathTraversalDetector.INSTANCE.run("test file", new String[]{"directory/test file.txt"})); } + + @Test + public void testCaseInsensitiveContainmentDetectsTraversal() { + assertAttack(PathTraversalDetector.INSTANCE.run("/ETC/passwd", new String[]{"/etc/passwd"})); + assertAttack(PathTraversalDetector.INSTANCE.run("/ETC/PASSWD", new String[]{"/etc/passwd"})); + assertAttack(PathTraversalDetector.INSTANCE.run("/HOME/USER/file.txt", new String[]{"/home/user/file.txt"})); + } }