wheels: Path containment checks compare paths case-insensitively on case-sensitive filesystems

Impact

Several checks that keep a file path inside an allowed directory compare the resolved path against the root without regard to letter case. On a case-sensitive filesystem (most Linux deployments), /srv/App and /srv/app are different directories, but these checks treat a path under the second as inside the first.

• Database dump output path: the CLI database dump confines its output file to the application root using a case-insensitive prefix comparison. An output path such as ../app/dump.sql from an application rooted at /srv/App is accepted and written outside the root, if that sibling directory exists and is writable. This command is a mutating CLI action behind the CLI gate (POST, loopback, password).
• Symlink-dependent checks: zip extraction entry checks, package mapping paths, the development assets/docs resolver, guide images and the image-tag path check use the same case-insensitive comparison on canonical paths. Each requires an existing symbolic link that points to a case-distinct sibling directory.

Patches

Fixed in 4.2.0. Path-containment checks now compare canonical paths exactly (case-sensitively), with separator-qualified boundaries and exact-root equality; the existing lexical and authorization checks are unchanged.

Workarounds

• Keep the CLI gate password secret and the dev tools disabled outside development.
• Avoid sibling directories whose names differ from the application, package or asset roots only by letter case, and avoid symbolic links inside those roots that point outside them.