Under certain conditions, disabling CSRF for a route doesnt work (Debugging included)

Node version: 8 Sails version (sails): 1.2.3

---

In https://github.com/balderdashy/sails/blob/b3afed7a6c67ba61b5202cab5954a388f05617c2/lib/hooks/security/csrf/index.js#L32

Due to the path being lowercased, if you have a RegEx pattern with uppercased letters, it will then fail to properly match against a given request URL further down and thus always return Forbidden.

https://github.com/balderdashy/sails/blob/b3afed7a6c67ba61b5202cab5954a388f05617c2/lib/hooks/security/csrf/index.js#L99

I’m not sure if there would be any regressions from removing the .toLowerCase() but certainly this shouldnt be desired behaviour.

[johnabrams7]

@kinsi55 We were able to reproduce this and were able to actually hit the root if we changed the CAPS to lowercased characters. We’re going to further investigate what the deal is with .toLowerCase() and any true regressions for working around it to allow CAPS in the RegEx patterns as well.

[kinsi55]

Nevermind the previous comment, that was related to my PR I mixed it up.

I dont have the time to setup a repo for this rn but the way you can repro it is by having a route like this:

'post r|/CAPS/(.+)$|foo': {
		action: 'anything',
		csrf: false
}

Trying to post to /CAPS/foo will then still require CSRF