Add CodeQL recommendation against Path.Combine

[carldybdahl-microsoft]

The docs for Path.Combine warns:

Important

This method assumes that the first argument is an absolute path and that the following argument or arguments are relative paths. If this is not the case, and particularly if any subsequent arguments are strings input by the user, call the Join or TryJoin method instead.

This commit adds a corresponding CodeQL query to recommend against Path.Combine.

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (1)

csharp/ql/test/query-tests/Bad Practices/Path Combine/PathCombine.cs:3

• [nitpick] The class name 'EmptyCatchBlock' does not convey its purpose related to Path.Combine testing. Consider renaming it to 'PathCombineTest' for better clarity.

class EmptyCatchBlock

[github-actions]

QHelp previews:

csharp/ql/src/Bad Practices/PathCombine.qhelp

Call to System.IO.Path.Combine

Path.Combine may silently drop its earlier arguments if its later arguments are absolute paths. E.g. Path.Combine("C:\\Users\\Me\\Documents", "C:\\Program Files\\") == "C:\\Program Files".

Recommendation

Use Path.Join instead.

References

• Microsoft Learn, .NET API browser, Path.Combine.
• Microsoft Learn, .NET API browser, Path.Join.

[michaelnebel]

I will start a DCA run to see how this impacts the security and quality suite.