Make path traversal containment check case-insensitive

[bitterpanda63]

Makes the user-input containment check in path traversal detection case-insensitive, matching the fix applied to the Node.js firewall in AikidoSec/firewall-node#1047.

Problem: On case-insensitive filesystems (macOS APFS, Windows NTFS), an attacker can submit a path like /ETC/PASSWD which resolves to /etc/passwd. The detection check strings.Contains(filePath, userInput) was case-sensitive, so /ETC/PASSWD would not be found in /etc/passwd and traversal would go undetected.

Fix: Changed to strings.Contains(strings.ToLower(filePath), strings.ToLower(userInput)).

See: AikidoSec/firewall-node#1047

Summary by Aikido

Security Issues: 0	Quality Issues: 0	Resolved Issues: 0

🐛 Bugfixes

• Made path traversal containment check case-insensitive to prevent bypass

^{More info}