[release/2.3] Merge internal commits for May

[wtgodbe]

No description provided.

[dotnet-policy-service]

Hi @wtgodbe. If this is not a tell-mode PR, please make sure to follow the instructions laid out in the servicing process document.
Otherwise, please add tell-mode label.

[Copilot]

Pull request overview

This PR merges a set of servicing changes into release/2.3, primarily tightening HTTP request handling around Transfer-Encoding + Content-Length (CL+TE) scenarios in Kestrel/HttpSys and hardening ResponseCaching cache-key construction against delimiter injection.

Changes:

• Kestrel + HttpSys: when both Transfer-Encoding and Content-Length are present, preserve the original length as X-Content-Length, remove Content-Length, and (by default) close the connection after responding; add coverage for these behaviors.
• ResponseCaching: reject (don’t cache / don’t serve from cache) requests whose key material contains the cache-key delimiter characters; add logging + tests.
• Servicing/build updates: patch packaging config tweaks and a dependency version bump.

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/Servers/Kestrel/test/FunctionalTests/ChunkedRequestTests.cs	Adds functional coverage ensuring CL+TE requests result in connection close after the response.
src/Servers/Kestrel/Core/test/Http1ConnectionTests.cs	Adds unit coverage verifying Content-Length is removed when Transfer-Encoding exists.
src/Servers/Kestrel/Core/src/Internal/Http/Http1MessageBody.cs	Implements CL+TE handling (move CL to X-Content-Length, remove CL, close connection by default).
src/Servers/HttpSys/test/FunctionalTests/RequestHeaderTests.cs	Adds functional tests around Transfer-Encoding parsing and CL removal/connection-close behavior.
src/Servers/HttpSys/src/RequestProcessing/ResponseBody.cs	Ensures disconnect flag is applied when request keep-alive was disabled; minor initialization cleanup.
src/Servers/HttpSys/src/RequestProcessing/Response.cs	Uses request keep-alive state as an input to connection lifetime decisions.
src/Servers/HttpSys/src/RequestProcessing/Request.cs	Implements CL+TE header normalization and keep-alive suppression (behind an AppContext switch).
src/Middleware/ResponseCaching/test/TestUtils.cs	Adds a new logged-message ID used by delimiter-rejection tests.
src/Middleware/ResponseCaching/test/ResponseCachingMiddlewareTests.cs	Adds tests validating delimiter rejection in cache lookup/storage paths + logging.
src/Middleware/ResponseCaching/test/ResponseCachingKeyProviderTests.cs	Adds tests for delimiter detection and exception behavior.
src/Middleware/ResponseCaching/src/ResponseCachingMiddleware.cs	Catches delimiter exceptions during lookup/storage key creation and disables caching for those requests.
src/Middleware/ResponseCaching/src/Internal/ResponseCachingKeyProvider.cs	Adds delimiter validation for key components and throws a dedicated exception on invalid input.
src/Middleware/ResponseCaching/src/Internal/LoggerExtensions.cs	Adds a debug log message for invalid cache key symbols.
src/Middleware/ResponseCaching/src/Internal/CacheKeyDelimiterException.cs	New internal exception used to signal invalid delimiter presence in cache-key components.
eng/PatchConfig.props	Adds a comment for 2.3.10 patch config (but contains a version typo).
Directory.Build.targets	Adjusts patch packaging selection logic for 2.3.10 (ship everything except Razor).
build/sources.props	Minor formatting adjustment in restore sources list.
build/dependencies.props	Bumps System.Security.Cryptography.Xml package version (8.0.2 → 8.0.3).

Comments suppressed due to low confidence (1)

src/Middleware/ResponseCaching/src/ResponseCachingMiddleware.cs:231

• Similarly, if CreateLookupVaryByKeys throws CacheKeyDelimiterException, TryServeFromCacheAsync returns false and bypasses the only-if-cached check later in the method. If Cache-Control: only-if-cached is present, this should still result in a 504 rather than falling through to the next middleware when no cached response can be served.

                try
                {
                    foreach (var varyKey in _keyProvider.CreateLookupVaryByKeys(context))
                    {
                        if (await TryServeCachedResponseAsync(context, await _cache.GetAsync(varyKey)))
                        {
                            return true;
                        }
                    }
                }
                catch (CacheKeyDelimiterException)
                {
                    _logger.LogRequestContainsInvalidCacheSymbols();
                    return false;
                }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.