test: add missing HttpOnly cookie fixture

[Swordoffik]

Test Case Submission

• I have read docs/CONTRIBUTING.md
• This test case is non-destructive — no disk, network, or process side effects
• Every payload is behind a dead-code guard (if (false), if False:, NEVER_RUN, …)
• Every host literal uses a reserved domain (.invalid, .example, example.com)
• Any credential is a published example value or a structurally valid dead placeholder
• I have included all required metadata (@id, @cwe, @severity, @language, @expected-detection, @description, @safe-guard)
• I marked the expected lines with VULNERABLE: and any correct-code lines with SAFE:
• I ran scripts/validate-test-case.sh and it passed
• I regenerated the catalog (python3 scripts/generate-catalog.py) and committed the result

Details

• Vulnerability type: Sensitive cookie without the HttpOnly attribute
• CWE ID: CWE-1004
• Language: JavaScript
• Expected detection: Yes
• Why this pattern matters: A session cookie without HttpOnly can be read by injected browser scripts, increasing the impact of an XSS flaw. The paired safe implementation provides a false-positive control with httpOnly: true.

Safety statement

The vulnerable and safe examples are both inside literal if (false) guards, so neither cookie-setting call can execute. The fixture contains no network destinations, filesystem access, process creation, destructive behavior, or credentials.

Scanner result

Pending CI.

Prepared with AI assistance under the repository's defensive-testing rules.