Java: Fix File.getName() path sanitizer

[owen-mc]

Reported in #22144. I have now downgraded it to a partial sanitizer. The return value has to be checked to confirm that it doesn't have any ".." components to become fully sanitized.

[Copilot]

Pull request overview

This PR fixes an unsound Java path-injection model by removing java.io.File.getName() as a full java/path-injection sanitizer, and adjusting the sanitizer logic/tests to treat it as safe only when paired with an explicit .. check—preventing false negatives like those reported in issue #22144.

Changes:

• Remove the barrierModel entry that previously treated File.getName()’s return value as a complete path-injection sanitizer.
• Update the path-sanitizer guard logic to recognize sanitization when a ..-check occurs after data derived from File.getName().
• Update the CWE-022 test to add a BAD case (no .. check) and keep a GOOD case (with a .. check), plus add a change note documenting new alerts.

Show a summary per file

File	Description
java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.java	Adjusts regression test to reflect that getName() alone is not a complete path-injection sanitizer; adds BAD + guarded GOOD variants.
java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected	Updates expected query results to include the newly-detected path-injection flow for the BAD case.
java/ql/lib/semmle/code/java/security/PathSanitizer.qll	Updates sanitizer-guard recognition so getName() can contribute to sanitization only when followed by a .. check.
java/ql/lib/ext/java.io.model.yml	Removes the barrierModel row marking File.getName() as a path-injection barrier.
java/ql/lib/change-notes/2026-07-11-file-getname-path-sanitizer.md	Documents the modeling change and that it may produce new alerts.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Low