Repository: dotnet/runtime
File: .github/skills/vmr-codeflow-status/scripts/Get-CodeflowStatus.ps1 (PowerShell)

Code before:
        try {
            [xml]$vdXml = $vdContent
            $sourceNode = $vdXml.Dependencies.Source
            if ($sourceNode -and $sourceNode.Sha -and $sourceNode.Sha -match '^[a-fA-F0-9]{40}$') {
                $versionDetailsVmrCommit = $sourceNode.Sha
                $branchVmrCommit = $versionDetailsVmrCommit
            }
        }
        catch {
            # Fall back to regex if XML parsing fails
            if ($vdContent -match '<Source\s+[^>]*Sha="([a-fA-F0-9]+)"') {
                $versionDetailsVmrCommit = $Matches[1]
                $branchVmrCommit = $versionDetailsVmrCommit
            }
        }
    }
}

# Second: scan commit messages for "Backflow from" / "Forward flow from" SHAs
if ($prCommits) {
    $reversedCommits = @($prCommits)
    [Array]::Reverse($reversedCommits)
    foreach ($c in $reversedCommits) {
        $msg = $c.messageHeadline
        if ($msg -match '(?:Backflow|Forward flow) from .+ / ([a-fA-F0-9]+)') {
            $commitMsgVmrCommit = $Matches[1]
            break
        }
    }
    # For forward flow (no Version.Details.xml source), commit messages are primary
    if (-not $branchVmrCommit -and $commitMsgVmrCommit) {
        $branchVmrCommit = $commitMsgVmrCommit
    }
}

if ($branchVmrCommit -or $vmrCommit) {
    Write-Section "Snapshot Validation"
    $usedBranchSnapshot = $false

    if ($branchVmrCommit) {
        # We have a branch-derived snapshot (from Version.Details.xml or commit message)
        $branchShort = Get-ShortSha $branchVmrCommit
        $sourceLabel = if ($versionDetailsVmrCommit -and $branchVmrCommit -eq $versionDetailsVmrCommit) { "Version.Details.xml" } else { "branch commit" }

        if ($vmrCommit) {
            $bodyShort = Get-ShortSha $vmrCommit
            if ($vmrCommit.StartsWith($branchVmrCommit) -or $branchVmrCommit.StartsWith($vmrCommit)) {
                Write-Host "  ✅ $sourceLabel ($branchShort) matches PR body ($bodyShort)" -ForegroundColor Green
            }
            else {
                Write-Host "  ⚠️  MISMATCH: $sourceLabel has $branchShort but PR body claims $bodyShort" -ForegroundColor Red

Review comment (security):
The regex fallback for `Version.Details.xml` captures any length hex string for `Sha` and then assigns it directly to `$branchVmrCommit`. This can accept malformed/partial values and (if length >= 40) will skip resolution/validation later. Tighten the regex (or add a post-check) to require exactly 40 hex chars (and consider normalizing case) before using it as the authoritative snapshot.

Code after:
$prCommits = $pr.commits

# --- Step 2b: Determine actual VMR snapshot on the PR branch ---
# Priority: 1) Version.Details.xml (ground truth), 2) commit messages, 3) PR body
$branchVmrCommit = $null
$commitMsgVmrCommit = $null
$versionDetailsVmrCommit = $null

# First: check eng/Version.Details.xml on the PR branch (authoritative source)
if (-not $isForwardFlow) {
    $vdContent = Invoke-GitHubApi "/repos/$Repository/contents/eng/Version.Details.xml?ref=$([System.Uri]::EscapeDataString($pr.headRefName))" -Raw
    if ($vdContent) {
        try {
            [xml]$vdXml = $vdContent
            $sourceNode = $vdXml.Dependencies.Source
            if ($sourceNode -and $sourceNode.Sha -and $sourceNode.Sha -match '^[a-fA-F0-9]{40}$') {
                $versionDetailsVmrCommit = $sourceNode.Sha
                $branchVmrCommit = $versionDetailsVmrCommit
            }
        }
        catch {
            # Fall back to regex if XML parsing fails
            if ($vdContent -match '<Source\s+[^>]*Sha="([a-fA-F0-9]{40})"') {
                $versionDetailsVmrCommit = $Matches[1]
                $branchVmrCommit = $versionDetailsVmrCommit
            }
        }
    }
}

# Second: scan commit messages for "Backflow from" / "Forward flow from" SHAs
if ($prCommits) {
    $reversedCommits = @($prCommits)
    [Array]::Reverse($reversedCommits)
    foreach ($c in $reversedCommits) {
        $msg = $c.messageHeadline
        if ($msg -match '(?:Backflow|Forward flow) from .+ / ([a-fA-F0-9]+)') {
            $commitMsgVmrCommit = $Matches[1]
            break
        }
    }
    # For forward flow (no Version.Details.xml source), commit messages are primary
    if (-not $branchVmrCommit -and $commitMsgVmrCommit) {
        $branchVmrCommit = $commitMsgVmrCommit
    }
}

if ($branchVmrCommit -or $vmrCommit) {
    Write-Section "Snapshot Validation"
    $usedBranchSnapshot = $false