Make path traversal containment check case-insensitive

[bitterpanda63]

Makes the user-input containment check in path traversal detection case-insensitive, matching the fix applied to the Node.js firewall in AikidoSec/firewall-node#1047.

Problem: On case-insensitive filesystems (macOS APFS, Windows NTFS), an attacker can submit a path like /ETC/PASSWD which resolves to /etc/passwd. The detection check user_input not in file_path was case-sensitive, so /ETC/PASSWD would not be found in /etc/passwd and traversal would go undetected.

Fix: Changed user_input not in file_path to user_input.lower() not in file_path.lower().

See: AikidoSec/firewall-node#1047

Summary by Aikido

Security Issues: 0	Quality Issues: 0	Resolved Issues: 0

🐛 Bugfixes

• Made path containment check case-insensitive to detect traversal attacks

^{More info}