Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.
Affected: NuGet: Microsoft.OpenApi.Kiota, NuGet: Microsoft.OpenApi.Kiota.Builder
### Summary
Microsoft Kiota emitted the `x-ms-kiota-info` extension's `clientClassName` or `clientNamespaceName` value **raw**, with no identifier or path sanitization, as **both** the generated client's class/namespace name **and** part of the generated output path. When `kiota generate` is run **without `-c/--class-name`** — the zero-config workflow that `x-ms-kiota-info` is explicitly designed for (the API provider supplies the names in the description so consumers don't have to) — an attacker who controls or tampers with the OpenAPI description could therefore:
- **(CWE-22) write the generated source file to a path outside the `-o` output directory** — e.g. `clientClassName: "/var/www/html/shell"`; and - **(CWE-94) inject arbitrary text into the generated class/namespace declaration**, corrupting the generated client.
Confirmed on Kiota **1.32.4** (the self-contained `linux-x64` release binary), i.e. **after** the earlier writer-sink hardening — that fix escaped property/enum/default/serialization sinks but never sanitized the provider-supplied `clientClassName` / `clientNamespaceName`.
### Details
`clientClassName` reached two unsanitized sinks (observed in the generated C#; the same raw emission occurred for Java, Go, TypeScript, Python, and PHP):
``` # output FILENAME (CWE-22): clientClassName flows into the file path clientClassName: "/abs/path/PWNED" -> /abs/path/PWNED.cs (written outside -o)
# class declaration (CWE-94): clientClassName flows verba…