Add CWE-94 eval/exec code-injection test case

[ezequiellich44-cmd]

Test Case Submission

• I have read docs/CONTRIBUTING.md
• This test case is non-destructive — no disk, network, or process side effects
• Every payload is behind a dead-code guard (if False:)
• Every host literal uses a reserved domain (none referenced)
• Any credential is a published example value or structurally valid dead placeholder
• I have included all required metadata (@id, @test-case, @cwe, @severity, @language, @expected-detection, @description, @safe-guard, @detection-target)
• I marked the expected lines with VULNERABLE: and correct-code lines with SAFE:
• I ran the validation (metadata, guards, syntax)
• I regenerated the catalog (scripts/generate-catalog.py) and committed the result

Details

• Vulnerability type: Code injection via eval() / exec() on attacker-controlled input
• CWE ID: CWE-94
• Language: Python
• Expected detection: Yes
• Why this pattern matters: eval()/exec() on request-derived data is a direct-to-RCE sink, but scanners
  frequently miss it when the taint passes through str.replace, base64.b64decode, or request.form. This case
  adds three vulnerable variants plus a safe counterpart using ast.literal_eval with an operator whitelist, so
  recall and false-positive control can both be measured.

Safety statement

Every payload sits inside if False: blocks and is unreachable dead code at runtime. There are no imports of
executable modules, no hosts, no credentials, no disk or socket I/O, and no dependency manifests. If the guard
were removed, the worst outcome would still be that eval of a non-existent expression cannot run.

[ezequiellich44-cmd]

Submitted per the uGig listing ("I will pay .25 per malicious submission"): a new CWE-94 code-injection test case with 3 VULNERABLE: markers and 1 SAFE: counterpart, catalog regenerated. All CI checks (Socket Security) pass. Happy to add more variants (deserialisation, SSTI, command injection) or adjust the safe counterpart on request.

[ezequiellich44-cmd]

/coinpay invoice 19 USD --crypto sol --wallet 3fZSMAyCEMhZwWiynbJDjoYNUT97aiV9BLzoUNroEMAz --for "Merged malware test-case submission PR #170: CWE-94 eval/exec (commit 4970de7)"

[ezequiellich44-cmd]

Heads-up for the payout pipeline: the CoinPayPortal workflow is failing for every /coinpay command in this repo (runs #11-#16) because the profullstack/coinpaybot@v0 action.yml embeds a secrets-context expression inside an input description, and GitHub errors while loading the action (Unrecognized named-value: 'secrets'). I opened a one-line fix: profullstack/coinpaybot#4 . Once that merges and the v0 ref points at it, re-running /coinpay here will work and all merged submissions across the corpus get paid.