Fix for Call to 'System.IO.Path.Combine' may silently drop its earlier arguments

[guitarrapc]

In general, to fix this class of problem you should ensure that the argument appended via Path.Combine cannot be an absolute path. You can either: (1) validate and reject/sanitize absolute paths, or (2) normalize relative paths using Path.GetFileName or similar to strip directory and root information, guaranteeing that Path.Combine always combines with the intended base directory.

The best targeted fix here, without changing functionality, is to ensure that fileName is only a file name, not an absolute or directory-containing path. We can do this by wrapping the concatenation in Path.GetFileName, which strips any directory components and any root from className. So we change the assignment to:

var fileName = Path.GetFileName(className) + extension;

This keeps the behavior identical for normal className values (no directory separators), but prevents a malicious or malformed className from turning into an absolute path or including directories. No extra imports are needed because System.IO.Path is already used in this file (and System.IO is implicitly available).

Concretely, in src/MySQLToCsharp/Generator.cs, update line 26 to compute fileName using Path.GetFileName(className) before combining it into outputFile. No other parts of the file need modification.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.