test: add fifteen Java vulnerability fixtures

[WNZhao]

Test Case Submission

• I have read docs/CONTRIBUTING.md
• All fifteen test cases are non-destructive — no disk, network, or process side effects
• Every payload is behind the NEVER_RUN dead-code guard
• There are no live hosts or credentials
• All required metadata is included
• Expected and safe lines use VULNERABLE: and SAFE: markers
• bash scripts/validate-test-case.sh passed all 6 groups
• The generated JSON and Markdown catalogs are committed

Details

This adds fifteen inert Java fixtures, each with a safe control:

1. CWE-22 path traversal through an untrusted child path
2. CWE-330 predictable reset token from java.util.Random
3. CWE-129 unvalidated array index
4. CWE-321 hardcoded AES key
5. CWE-327 password hashing with MD5
6. CWE-113 HTTP response splitting through an unsanitized header
7. CWE-90 LDAP filter injection
8. CWE-601 open redirect through an unvalidated URI
9. CWE-639 IDOR through a missing ownership check
10. CWE-942 credentialed CORS with an arbitrary reflected origin
11. CWE-1333 untrusted regular-expression compilation
12. CWE-190 integer overflow in a size product
13. CWE-327 AES configured in ECB mode
14. CWE-295 trust-all TLS certificate manager
15. CWE-297 unconditional TLS hostname approval

The batch expands Java coverage with taint-flow, authorization, cryptography, TLS, numeric, and configuration patterns while retaining one explicit safe counterpart per case.

Safety statement

Every method is guarded by the compile-time false NEVER_RUN constant. The fixtures only construct strings, maps, paths, URIs, patterns, cipher/verifier objects, or perform in-memory arithmetic. They never open, read, write, delete, spawn, connect, transmit, allocate attacker-sized buffers, or process plaintext. Placeholder values secure no data.

Verification

• repository safety validator: all 6 groups passed
• generated catalogs: current at 142 test cases
• javac: passed for all fifteen new Java files
• git diff --check: passed

Scanner result

Pending CI.

[WNZhao]

Follow-up delivery summary (2026-08-25): PRs #201–#213 add 195 additional inert scanner fixtures across Ruby, Go, Rust, Swift, C, C++, Shell, Lua, Perl, Dart, Objective-C, TypeScript, and PHP. Every batch passes the repository safety validator plus its language-specific syntax/static checks; all GitHub checks are green and each PR is currently mergeable.

CoinPay proposals sent for review:

• PROP-001: PRs test: add 15 Ruby security scanner fixtures #201–test: add 15 C++ security scanner fixtures #206, 90 files, $22.50
• PROP-002: PRs test: add 15 Shell security scanner fixtures #207–test: add 15 PHP security scanner fixtures #213, 105 files, $26.25

Both proposals explicitly allow a counter based on the actual accepted file count. No additional invoice has been created; I will invoice only after acceptance.

[WNZhao]

Consolidated review request: PRs #200–#213 are complete and CI-clean, covering 210 independent inert fixtures across 14 languages. Before I add any more batches, could you confirm whether these files are accepted under the published $0.25-per-file bounty and whether you prefer one consolidated invoice after merge? I will invoice only the files you explicitly accept.