[Vardhman Gupta (Kaap10)]

Description

Extends PathTraversalOutputScorer to detect traversal payloads targeting modern OpenSSH default private key filenames (id_ed25519, id_ecdsa, id_dsa, and FIDO2 id_ed25519_sk/id_ecdsa_sk) alongside id_rsa.

• Updated _DEFAULT_PATTERNS["Path Traversal to Sensitive File"] in PathTraversalOutputScorer to match id_(?:rsa|dsa|(?:ecdsa|ed25519)(?:_sk)?) while preserving existing _FILE_END boundaries.
• Added positive regression tests covering id_dsa, id_ecdsa, id_ed25519, id_ecdsa_sk, id_ed25519_sk, backslash separators, percent-encoding, null-byte truncation (%00), and sentence-ending periods.
• Added negative boundary tests confirming .pub public keys, .bak backups, custom suffixes (id_ed25519_custom), and single-parent walks (../.ssh/id_ed25519) remain False.

Demonstration

For "../../.ssh/id_ed25519":

• Before: score_value="false" (rationale: "")
• After: score_value="true" ("Matched: Path Traversal to Sensitive File")

For "../../.ssh/id_ed25519.pub":

• Before & After: score_value="false" (public key safely excluded by _FILE_END)

Closes #4232

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.