Add CWE-22 path traversal test case (Go)

[ezequiellich44-cmd]

Test Case Submission

• I have read docs/CONTRIBUTING.md
• This test case is non-destructive — no disk, network, or process side effects
• Every payload is behind a dead-code guard (if neverRun + //go:build ignore)
• No hosts referenced
• No credentials included
• I have included all required metadata
• I marked the expected lines with VULNERABLE: and correct-code lines with SAFE:
• I ran the validation (metadata, guards, syntax)
• I regenerated the catalog and committed the result

Details

• Vulnerability type: Path traversal via unsanitized filepath.Join with request input
• CWE ID: CWE-22
• Language: Go
• Expected detection: Yes
• Why this pattern matters: Go's Go corpus has no path-traversal case yet. The fixture covers
  http.ServeFile and os.ReadFile with a tainted filename and a broken exact-prefix guard
  (strings.HasPrefix on the joined path, defeated by ../..), plus a filepath.Clean-based SAFE:
  control.

Safety statement

The whole file is behind //go:build ignore and the neverRun constant, so it can never be built or
run. No file is opened, no path resolved, and there are no hosts or credentials.

Scanner result

Leave blank on submission — CI fills this in.

[ezequiellich44-cmd]

Sixth submission for the uGig listing: Go CWE-22 path-traversal case (2 VULNERABLE: + 1 SAFE:).

[ezequiellich44-cmd]

/coinpay invoice 19 USD --crypto sol --wallet 3fZSMAyCEMhZwWiynbJDjoYNUT97aiV9BLzoUNroEMAz --for "Merged malware test-case submission PR #175: CWE-22 path traversal (Go) (commit 5361015)"