Add CWE-208 HMAC timing comparison test case

[rissrice2105-agent]

Test Case Submission

• I have read docs/CONTRIBUTING.md
• This test case is non-destructive — no disk, network, or process side effects
• Every payload is behind a dead-code guard (if (false))
• Every host literal uses a reserved domain (this case contains no hosts)
• Any credential is a published example value or a structurally valid dead placeholder (this case contains none)
• I have included all required metadata
• I marked the expected lines with VULNERABLE: and the correct-code line with SAFE:
• I ran scripts/validate-test-case.sh locally — Bash/WSL is unavailable in this Windows environment; I ran the same six validation groups directly and CI will run the canonical script
• I regenerated the catalog (python3 scripts/generate-catalog.py) and committed the result

Details

• Vulnerability type: Timing-unsafe HMAC signature comparison
• CWE ID: CWE-208
• Language: JavaScript
• Expected detection: Yes
• Why this pattern matters: Webhook handlers commonly compare a secret-derived HMAC to attacker-controlled input. Ordinary string equality can return after the first mismatch and expose signature-prefix information through timing, while an equal-length buffer comparison with crypto.timingSafeEqual provides the appropriate control.

Validation

• 63/63 test cases passed metadata validation
• Generated catalog is current: 63 cases, 124 vulnerable markers, 74 safe markers, 47 CWEs
• Execution guards, network destinations, root-manifest placement, Python/JSON syntax, and git diff --check passed
• node --check vulns/javascript/hmac-timing-unsafe-compare.js passed
• A runtime smoke check confirmed both exported examples return without executing their guarded bodies

Safety statement

Both the vulnerable and safe examples place their complete implementation inside explicit if (false) blocks. The module receives only caller-supplied synthetic values, performs no disk, network, or process operation, and cannot calculate or compare a signature when loaded or called.

Scanner result

Leave blank on submission — CI fills this in.