Repository: PowerShell/PowerShell
File: src/System.Management.Automation/security/wldpNativeMethods.cs (C#)

Code before:
                    options: WLDP_EXECUTION_EVALUATION_OPTIONS.WLDP_EXECUTION_EVALUATION_OPTION_NONE,
                    fileHandle: fileHandle.DangerousGetHandle(),
                    auditInfo: auditMsg,
                    result: out WLDP_EXECUTION_POLICY canExecuteResult);

                PSEtwLog.LogWDACQueryEvent("WldpCanExecuteFile", filePath, hr, (int)canExecuteResult);

                if (hr >= 0)
                {
                    switch (canExecuteResult)
                    {
                        case WLDP_EXECUTION_POLICY.WLDP_CAN_EXECUTE_ALLOWED:
                            result = SystemScriptFileEnforcement.Allow;
                            return true;

                        case WLDP_EXECUTION_POLICY.WLDP_CAN_EXECUTE_BLOCKED:
                            result = SystemScriptFileEnforcement.Block;
                            return true;

                        case WLDP_EXECUTION_POLICY.WLDP_CAN_EXECUTE_REQUIRE_SANDBOX:
                            result = SystemScriptFileEnforcement.AllowConstrained;
                            return true;

                        default:
                            // Fall through to legacy system policy checks.
                            Debug.Assert(false, $"Unknown policy result returned from WldCanExecute: {canExecuteResult}");
                            break;
                    }
                }

                // If HResult is unsuccessful (such as E_NOTIMPL (0x80004001)), fall through to legacy system checks.
            }
            catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException)
            {
                // Fall back to legacy system policy checks.
                s_wldpCanExecuteAvailable = false;
                PSEtwLog.LogWDACQueryEvent("WldpCanExecuteFile_Failed", filePath, ex.HResult, 0);
            }

            result = default;
            return false;
        }

        /// <summary>
        /// Gets lockdown policy as applied to a file.
        /// </summary>
        /// <returns>An EnforcementMode that describes policy.</returns>
        public static SystemEnforcementMode GetLockdownPolicy(string path, SafeHandle handle)
        {
            SystemScriptFileEnforcement modernMode = GetLockdownPolicy(path, handle, canExecuteResult: null);
            Debug.Assert(

Review comment (suggestion):
We return early here in the original code, but the early return is not in the new changes. In the new changes, we always call to `GetLockdownPolicy` even if `systemLockdownPolicy is None`.

Code after:
                string fileName = System.IO.Path.GetFileNameWithoutExtension(filePath);
                string auditMsg = $"PowerShell ExternalScriptInfo reading file: {fileName}";

                int hr = WldpNativeMethods.WldpCanExecuteFile(
                    host: PowerShellHost,
                    options: WLDP_EXECUTION_EVALUATION_OPTIONS.WLDP_EXECUTION_EVALUATION_OPTION_NONE,
                    fileHandle: fileHandle.DangerousGetHandle(),
                    auditInfo: auditMsg,
                    result: out WLDP_EXECUTION_POLICY canExecuteResult);

                PSEtwLog.LogWDACQueryEvent("WldpCanExecuteFile", filePath, hr, (int)canExecuteResult);

                if (hr >= 0)
                {
                    switch (canExecuteResult)
                    {
                        case WLDP_EXECUTION_POLICY.WLDP_CAN_EXECUTE_ALLOWED:
                            result = SystemScriptFileEnforcement.Allow;
                            return true;

                        case WLDP_EXECUTION_POLICY.WLDP_CAN_EXECUTE_BLOCKED:
                            result = SystemScriptFileEnforcement.Block;
                            return true;

                        case WLDP_EXECUTION_POLICY.WLDP_CAN_EXECUTE_REQUIRE_SANDBOX:
                            result = SystemScriptFileEnforcement.AllowConstrained;
                            return true;

                        default:
                            // Fall through to legacy system policy checks.
                            Debug.Assert(false, $"Unknown policy result returned from WldCanExecute: {canExecuteResult}");
                            break;
                    }
                }

                // If HResult is unsuccessful (such as E_NOTIMPL (0x80004001)), fall through to legacy system checks.
            }
            catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException)
            {
                // Fall back to legacy system policy checks.
                s_wldpCanExecuteAvailable = false;
                PSEtwLog.LogWDACQueryEvent("WldpCanExecuteFile_Failed", filePath, ex.HResult, 0);
            }

            result = default;
            return false;
        }

        /// <summary>
        /// Gets lockdown policy as applied to a file.
        /// </summary>