DangerousFileDetectorTests.ItShouldDetectFileWithMarkOfTheWeb fails on IE-less vs2026.pre.scout image

[dsplaisted]

Summary

Microsoft.DotNet.Cli.Utils.Tests.DangerousFileDetectorTests.ItShouldDetectFileWithMarkOfTheWeb fails on the new windows.amd64.vs2026.pre.scout CI image (Windows Server 2025 + VS 2026 preview, with Internet Explorer removed).

Expected boolean to be True, but found False.

Root cause

The test writes a Zone.Identifier alternate data stream (ZoneId=3, Internet zone) and asserts that DangerousFileDetector.IsDangerous(file) returns true. DangerousFileDetector relies on the legacy IE/urlmon InternetSecurityManager and MapUrlToZone.

On the IE-stripped scout image this is unreliable and inconsistent:

• The InternetSecurityManager COM class still instantiates (urlmon is present), but MapUrlToZone no longer reliably honors the Zone.Identifier stream.
• Worse, the behavior diverges between code paths: an independent MapUrlToZone probe can report the file as Internet zone (zone >= URLZONE_INTERNET) while the product's DangerousFileDetector.IsDangerous (CsWin32 path) reports it as not dangerous on the same image. So capability-gating the assertion on an independent probe does not work — the gate and the product disagree.

Repro

• Build 1477806 (PR Disable failing Mark-of-the-Web test and fix parallel test failures #54945), TestBuild: windows (x64) leg on windows.amd64.vs2026.pre.scout.open.

Mitigation

Disabling the test on the affected image via [Ignore] pointing at this issue.

Follow-up

Decide on a robust long-term approach, e.g.:

• Assert only the deterministic negative case (a file without Mark-of-the-Web is never dangerous), and drop the environment-dependent positive assertion; or
• Reliably detect functional Mark-of-the-Web support before asserting; or
• Skip the positive assertion on images where the IE/urlmon zone manager is non-functional.

[dsplaisted]

@JeremyKuhne Any ideas on this and how we should handle mark of the web testing? It looks like there are some changes in new images that don't have IE in the OS.