Change signature validation logic to call first without the file content (#14849)

src/System.Management.Automation/security/SecurityManager.cs

@@ -11,6 +11,7 @@ using System.Management.Automation.Language;
 using System.Management.Automation.Security;
 using System.Security;
 using System.Security.Cryptography.X509Certificates;
+using System.Text;
 
 using Dbg = System.Management.Automation;
 
@@ -516,15 +517,28 @@ namespace Microsoft.PowerShell
             }
         }
 
+        // Check the signature via the SIP which should never erroneously validate an invalid signature
+        // or altered script.
         private static Signature GetSignatureWithEncodingRetry(string path, ExternalScriptInfo script)
         {
-            string verificationContents = System.Text.Encoding.Unicode.GetString(script.OriginalEncoding.GetPreamble()) + script.ScriptContents;
-            Signature signature = SignatureHelper.GetSignature(path, verificationContents);
-
-            // If the file was originally ASCII or UTF8, the SIP may have added the Unicode BOM
-            if ((signature.Status != SignatureStatus.Valid) && (script.OriginalEncoding != System.Text.Encoding.Unicode))
+            // Invoke the SIP directly with the most simple method
+            Signature signature = SignatureHelper.GetSignature(path, fileContent: null);
+            if (signature.Status == SignatureStatus.Valid)
             {
-                verificationContents = System.Text.Encoding.Unicode.GetString(System.Text.Encoding.Unicode.GetPreamble()) + script.ScriptContents;
+                return signature;
+            }
+
+            // try harder to validate the signature by being explicit about encoding
+            // and providing the script contents
+            string verificationContents = Encoding.Unicode.GetString(script.OriginalEncoding.GetPreamble()) + script.ScriptContents;
+            signature = SignatureHelper.GetSignature(path, verificationContents);
+
+            // A last ditch effort -
+            // If the file was originally ASCII or UTF8, the SIP may have added the Unicode BOM
+            if (signature.Status != SignatureStatus.Valid
+                && script.OriginalEncoding != Encoding.Unicode)
+            {
+                verificationContents = Encoding.Unicode.GetString(Encoding.Unicode.GetPreamble()) + script.ScriptContents;
                 Signature fallbackSignature = SignatureHelper.GetSignature(path, verificationContents);
 
                 if (fallbackSignature.Status == SignatureStatus.Valid)