Add JWT decode-without-verification test case

[rissrice2105-agent]

Test Case Submission

• I have read docs/CONTRIBUTING.md
• This test case is non-destructive — no disk, network, or process side effects
• Every payload is behind a dead-code guard (if (false))
• Every host literal uses the reserved .invalid domain
• No credentials are included
• I included all required metadata
• I marked one VULNERABLE: line and one SAFE: control line
• I ran scripts/validate-test-case.sh locally (Bash is unavailable on this Windows host; all six checks were reproduced individually and passed, and CI will run the exact script)
• I regenerated and committed both catalogs

Details

• Vulnerability type: JWT signature validation bypass via decode-only parsing
• CWE ID: CWE-347
• Language: JavaScript
• Expected detection: Yes
• Why this pattern matters: jwt.decode() parses attacker-controlled claims without authenticating them. Using the decoded role for authorization lets a forged token select an administrative path. The adjacent jwt.verify() implementation is the false-positive control.

Validation

• scripts/check-metadata.py: 32 test cases, all metadata present
• scripts/generate-catalog.py --check: catalog current
• node --check vulns/javascript/jwt-decode-without-verify.js: passed
• Python/JSON corpus syntax checks: passed
• Dead-code guard, reserved-host, root-manifest, and git diff --check checks: passed

Safety statement

Both vulnerable and safe examples are inside literal if (false) guards. The file performs no disk writes, process spawning, installation, or live network access, contains no credential material, and names only reserved .invalid hosts. Checking out or scanning the repository cannot activate either token path.

Scanner result

Pending CI.