Add 20 inert JavaScript and Python security scanner test cases

[ArturoAvendanoMaldonado]

Test Case Submission — batch of 20 (uGig gig 19c2b070)

• I have read docs/CONTRIBUTING.md
• Every test case is non-destructive — no disk, network, or process side effects
• Every payload is behind a dead-code guard (if (false) or if False:)
• Every host literal uses a reserved domain (.invalid, .example, example.com)
• Any credential or key literal is an obviously synthetic, dead placeholder
• All required metadata is included (@id, @cwe, @severity, @language, @expected-detection, @description, @safe-guard)
• Expected lines are marked with VULNERABLE: and correct-code lines with SAFE:
• scripts/validate-test-case.sh passed all 6 validation groups
• The catalog was regenerated and both generated catalog files are committed

Details

This batch adds 20 distinct inert scanner fixtures, each with a vulnerable pattern and a safe control:

#	File	CWE	Severity	Test case
1	vulns/javascript/cookie-security-flags.js	CWE-614	medium	Session cookie without Secure
2	vulns/javascript/cors-wildcard-credentials.js	CWE-942	high	Credentialed wildcard CORS
3	vulns/javascript/hardcoded-crypto-key.js	CWE-321	high	Hardcoded cryptographic key
4	vulns/javascript/host-header-password-reset.js	CWE-346	high	Host-header password-reset poisoning
5	vulns/javascript/http-header-injection.js	CWE-113	high	HTTP response splitting
6	vulns/javascript/insecure-random-token.js	CWE-330	high	Predictable security token
7	vulns/javascript/log-injection.js	CWE-117	medium	Log injection
8	vulns/javascript/mass-assignment-object-assign.js	CWE-915	high	Mass assignment
9	vulns/javascript/nosql-injection-mongodb.js	CWE-943	high	MongoDB NoSQL injection
10	vulns/javascript/tls-reject-unauthorized-false.js	CWE-295	high	Disabled TLS validation
11	vulns/python/csv-formula-injection.py	CWE-1236	medium	CSV formula injection
12	vulns/python/excessive-data-exposure.py	CWE-201	high	Excessive API data exposure
13	vulns/python/flask-debug-enabled.py	CWE-489	high	Flask debug enabled
14	vulns/python/hardcoded-session-secret.py	CWE-798	high	Hardcoded session secret
15	vulns/python/ldap-injection.py	CWE-90	high	LDAP injection
16	vulns/python/missing-admin-authorization.py	CWE-862	high	Missing admin authorization
17	vulns/python/negative-price-validation.py	CWE-20	medium	Missing price range validation
18	vulns/python/plaintext-password-storage.py	CWE-256	critical	Plaintext password storage
19	vulns/python/weak-password-hash.py	CWE-759	high	Unsalted password hash
20	vulns/python/xpath-injection.py	CWE-643	high	XPath injection

• Languages: JavaScript (10), Python (10)
• Expected detection: Yes for all 20 cases
• Coverage impact: catalog grows from 39 to 59 cases and from 24 to 43 CWE categories
• Why these patterns matter: they expand data-flow and insecure-configuration coverage while adding one explicit SAFE: control for every vulnerable pattern.

Safety statement

All JavaScript payloads are visibly unreachable behind if (false); all Python payloads are behind if False:. The fixtures perform no disk writes, network requests, process creation, dependency installation, deletion, resource exhaustion, or other side effects. Host literals use reserved domains. The cryptographic key and session secret are repeating test-only placeholders that cannot authenticate to or protect any real system. Removing a guard still would not target a live service.

Validation

• scripts/validate-test-case.sh: 6/6 validation groups passed
• python3 scripts/generate-catalog.py: completed
• JavaScript syntax checks: passed
• Generated catalog totals: 59 cases, 43 CWE categories, 113 VULNERABLE: markers, 67 SAFE: markers

Scanner result

Left blank on submission; CI will report ThreatCrush results.