Sounds like the content is actually stripped right away before even the request is sent, I see the following data sent in the request when the macro is created:
sourceSyntax "xwiki/2.1" wysiwygRestricted "false" stripHTMLEnvelope "false" fromHTML "true" toHTML "true" text '<!DOCTYPE+html>\n<html+xmlns="http://www.w3.org/1999/xhtml"+lang="en"+xml:lang="en"><body><p><!--startmacro:code|-|language="none"|-|cat+>+/var/www/html/info.php+<<EOF\r\n++++++\r\n+++EOF\r\n--><!--stopmacro--></p></body></html>'