Repository: microsoft/CSS-Exchange
File: Shared/IISFunctions/Get-IISModules.ps1 (PowerShell)

Code before:
                if ($Path -match "\%.+\%") {
                    Write-Verbose "Environment variable found in path: $Path"
                    # Assuming that we have the env var always at the beginning of the string and no other vars within the string
                    # Example: %windir%\system32\someexample.dll
                    $preparedPath = ($Path.Split("%", [System.StringSplitOptions]::RemoveEmptyEntries))
                    if ($preparedPath.Count -eq 2) {
                        if ($preparedPath[0] -notmatch "\\.+\\") {
                            $varPath = [System.Environment]::GetEnvironmentVariable($preparedPath[0])
                            $returnPath = [String]::Join("", $varPath, $($preparedPath[1]))
                        }
                    }
                }
            } else {
                $returnPath = $null
            }

            return $returnPath
        }

        function GetIISModulesSignatureStatus {
            [CmdletBinding()]
            param(
                [Parameter(Mandatory = $true)]
                [object[]]$Modules,
                [Parameter(Mandatory = $false)]
                [string[]]$ModulesToSkip
            )
            process {
                try {
                    $iisModulesList = New-Object 'System.Collections.Generic.List[object]'
                    if ($Modules.Count -ge 1) {
                        Write-Verbose "At least one module is loaded by IIS"
                        foreach ($m in $Modules) {
                            Write-Verbose "Now processing module: $($m.Name)"
                            $isModuleSigned = $false
                            $signatureDetails = [PSCustomObject]@{
                                Signer            = $null
                                SignatureStatus   = -1
                                IsMicrosoftSigned = $null
                            }

                            $moduleFilePath = GetModulePath -Path $m.Image

                            if (($ModulesToSkip.Count -eq 0) -or
                                (-not($ModulesToSkip.ToLower().Contains($moduleFilePath.ToLower())))) {
                                Write-Verbose "Module is not on skip list - starting validation process"
                                try {
                                    Write-Verbose "Querying file signing information"
                                    $signature = Get-AuthenticodeSignature -FilePath $moduleFilePath -ErrorAction Stop
                                    Write-Verbose "Performing signature status validation. Status: $($signature.Status)"
                                    # Signature Status Enum Values:

Review comment (bug):
Let's not do it like this. Keep `GetModulePath` the same, just filter out the modules that we don't want prior to passing to `GetModulePath`, since we aren't returning them at all anyways. When we do the filter, just also add a debug note about it. 

Code after:

                if ($Path -match "\%.+\%") {
                    Write-Verbose "Environment variable found in path: $Path"
                    # Assuming that we have the env var always at the beginning of the string and no other vars within the string
                    # Example: %windir%\system32\someexample.dll
                    $preparedPath = ($Path.Split("%", [System.StringSplitOptions]::RemoveEmptyEntries))
                    if ($preparedPath.Count -eq 2) {
                        if ($preparedPath[0] -notmatch "\\.+\\") {
                            $varPath = [System.Environment]::GetEnvironmentVariable($preparedPath[0])
                            $returnPath = [String]::Join("", $varPath, $($preparedPath[1]))
                        }
                    }
                }
            } else {
                $returnPath = $null
            }

            return $returnPath
        }
        function GetIISModulesSignatureStatus {
            [CmdletBinding()]
            param(
                [Parameter(Mandatory = $true)]
                [object[]]$Modules
            )
            process {
                try {
                    $iisModulesList = New-Object 'System.Collections.Generic.List[object]'
                    if ($Modules.Count -ge 1) {
                        Write-Verbose "At least one module is loaded by IIS"
                        foreach ($m in $Modules) {
                            Write-Verbose "Now processing module: $($m.Name)"
                            $isModuleSigned = $false
                            $signatureDetails = [PSCustomObject]@{
                                Signer            = $null
                                SignatureStatus   = -1
                                IsMicrosoftSigned = $null
                            }

                            $moduleFilePath = GetModulePath -Path $m.Image

                            try {
                                Write-Verbose "Querying file signing information"
                                $signature = Get-AuthenticodeSignature -FilePath $moduleFilePath -ErrorAction Stop
                                Write-Verbose "Performing signature status validation. Status: $($signature.Status)"
                                # Signature Status Enum Values:
                                # <0> Valid, <1> UnknownError, <2> NotSigned, <3> HashMismatch,
                                # <4> NotTrusted, <5> NotSupportedFileFormat, <6> Incompatible,
                                # https://docs.microsoft.com/dotnet/api/system.management.automation.signaturestatus
                                if (($null -ne $signature.Status) -and
                                    ($signature.Status -ne 1) -and