Fix Path.Combine security warnings and MSTest assertion code smells

[Copilot]

Addresses CodeQL path traversal warnings and MSTest analyzer recommendations.

Changes

Path Security

• Added PathHelpers.SafePathCombine that validates relative paths before combining:
  • Rejects absolute paths and .. sequences
  • Verifies combined path stays within base directory using Path.GetFullPath
• Replaced 4 Path.Combine calls (3 in Validation.cs, 1 in IntegrationTests.cs)
• Updated CodeQL config to exclude validated usage in PathHelpers

// Before
var logFile = Path.Combine(tempDir.DirectoryPath, "test.log");

// After
var logFile = PathHelpers.SafePathCombine(tempDir.DirectoryPath, "test.log");

Test Assertions

• Updated 21 assertions across test files to use MSTest-specific methods:
  • Assert.IsTrue(x.Contains(y)) → Assert.Contains(y, x)
  • Assert.IsFalse(x.Contains(y)) → Assert.DoesNotContain(y, x)
• Improves failure diagnostics and aligns with MSTest best practices

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Code Quality</issue_title>
<issue_description>There are numerous code-quality issues reported for the project. Those around System.IO.Path.Combine could be handled using a SafePathCombine like https://github.com/demaconsulting/BuildMark/blob/main/src/DemaConsulting.BuildMark/PathHelpers.cs and its associated tests and the codeql-config.yml file.

Please fix the following issues:

src/DemaConsulting.TemplateDotNetTool/Validation.cs(106): warning [cs/path-combine] Call to
‘System.IO.Path.Combine’ may silently drop its earlier arguments.  
src/DemaConsulting.TemplateDotNetTool/Validation.cs(174): warning [cs/path-combine] Call to
‘System.IO.Path.Combine’ may silently drop its earlier arguments.  
src/DemaConsulting.TemplateDotNetTool/Validation.cs(332): warning [cs/path-combine] Call to
‘System.IO.Path.Combine’ may silently drop its earlier arguments.  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(40): warning [cs/path-combine] Call to
‘System.IO.Path.Combine’ may silently drop its earlier arguments.  
test/DemaConsulting.TemplateDotNetTool.Tests/ContextTests.cs(163): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/ContextTests.cs(181): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/ContextTests.cs(200): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/ContextTests.cs(224): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.DoesNotContain’ instead of ‘Assert.IsFalse’  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(63): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.DoesNotContain’ instead of ‘Assert.IsFalse’  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(64): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.DoesNotContain’ instead of ‘Assert.IsFalse’  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(84): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(85): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(86): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(106): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(107): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(138): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(139): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(195): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/IntegrationTests.cs(221): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/ProgramTests.cs(45): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.DoesNotContain’ instead of ‘Assert.IsFalse’  
test/DemaConsulting.TemplateDotNetTool.Tests/ProgramTests.cs(46): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.DoesNotContain’ instead of ‘Assert.IsFalse’  
test/DemaConsulting.TemplateDotNetTool.Tests/ProgramTests.cs(70): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/ProgramTests.cs(71): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/ProgramTests.cs(72): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/ProgramTests.cs(73): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/ProgramTests.cs(97): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/ProgramTests.cs(121): INFO CODE_SMELL
[external_roslyn:MSTEST0037] Use ‘Assert.Contains’ instead of ‘Assert.IsTrue’  
test/DemaConsulting.TemplateDotNetTool.Tests/ProgramTests....

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

- Fixes demaconsulting/TemplateDotNetTool#2

<!-- START COPILOT CODING AGENT TIPS -->
---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips](https://gh.io/copilot-coding-agent-tips) in the docs.