fix: support spaced composite aspect ratios

library/HTMLPurifier/AttrDef/CSS/Ratio.php

@@ -1,7 +1,9 @@
 <?php
 
 /**
- * Validates a ratio as defined by the CSS spec.
+ * Validates a ratio as defined by the CSS spec, or the aspect-ratio
+ * property's `auto || <ratio>` grammar that allows auto to be combined
+ * with a ratio in either order.
  */
 class HTMLPurifier_AttrDef_CSS_Ratio extends HTMLPurifier_AttrDef
 {
@@ -19,6 +21,23 @@ public function validate($ratio, $config, $context)
     {
         $ratio = $this->parseCDATA($ratio);
 
+        if (strtolower($ratio) === 'auto') {
+            return 'auto';
+        }
+
+        // Peel auto off before splitting on '/', so it isn't confused
+        // with the space CSS allows inside the ratio itself (e.g. "16 / 9").
+        $len = strlen($ratio);
+        $auto_before = false;
+        $auto_after = false;
+        if ($len >= 5 && strncasecmp($ratio, 'auto ', 5) === 0) {
+            $auto_before = true;
+            $ratio = ltrim(substr($ratio, 5));
+        } elseif ($len >= 5 && strcasecmp(substr($ratio, -5), ' auto') === 0) {
+            $auto_after = true;
+            $ratio = rtrim(substr($ratio, 0, -5));
+        }
+
         $parts = explode('/', $ratio, 2);
         $length = count($parts);
 
@@ -29,17 +48,25 @@ public function validate($ratio, $config, $context)
         $num = new \HTMLPurifier_AttrDef_CSS_Number();
 
         if ($length === 1) {
-            return $num->validate($parts[0], $config, $context);
-        }
+            $result = $num->validate($parts[0], $config, $context);
+        } else {
+            $num1 = $num->validate($parts[0], $config, $context);
+            $num2 = $num->validate($parts[1], $config, $context);
 
-        $num1 = $num->validate($parts[0], $config, $context);
-        $num2 = $num->validate($parts[1], $config, $context);
+            $result = ($num1 === false || $num2 === false) ? false : $num1 . '/' . $num2;
+        }
 
-        if ($num1 === false || $num2 === false) {
+        if ($result === false) {
             return false;
         }
 
-        return $num1 . '/' . $num2;
+        if ($auto_before) {
+            return 'auto ' . $result;
+        }
+        if ($auto_after) {
+            return $result . ' auto';
+        }
+        return $result;
     }
 }
 

library/HTMLPurifier/CSSDefinition.php

@@ -301,12 +301,7 @@ protected function doSetup($config)
                     $trusted_max_wh
                 );
 
-        $this->info['aspect-ratio'] = new HTMLPurifier_AttrDef_CSS_Multiple(
-            new HTMLPurifier_AttrDef_CSS_Composite([
-                new HTMLPurifier_AttrDef_CSS_Ratio(),
-                new HTMLPurifier_AttrDef_Enum(['auto']),
-            ])
-        );
+        $this->info['aspect-ratio'] = new HTMLPurifier_AttrDef_CSS_Ratio();
 
         // text-decoration and related shorthands
         $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration();

tests/HTMLPurifier/AttrDef/CSS/RatioTest.php

@@ -18,6 +18,17 @@ public function test()
         $this->assertDef('/12', false);
         $this->assertDef('1/', false);
         $this->assertDef('asdf', false);
+
+        $this->assertDef('auto');
+        $this->assertDef('AUTO', 'auto');
+        $this->assertDef('auto 1/2');
+        $this->assertDef('1/2 auto');
+        $this->assertDef('auto 1 / 2', 'auto 1/2');
+        $this->assertDef('1 / 2 auto', '1/2 auto');
+
+        $this->assertDef('auto1/2', false);
+        $this->assertDef('1/2auto', false);
+        $this->assertDef('auto auto', false);
     }
 }
 

tests/HTMLPurifier/AttrDef/CSSTest.php

@@ -78,6 +78,9 @@ public function test()
         $this->assertDef('aspect-ratio:auto;');
         $this->assertDef('aspect-ratio:16/9 auto;');
         $this->assertDef('aspect-ratio:auto 16/9;');
+        $this->assertDef('aspect-ratio:16 / 9;', 'aspect-ratio:16/9;');
+        $this->assertDef('aspect-ratio:16 / 9 auto;', 'aspect-ratio:16/9 auto;');
+        $this->assertDef('aspect-ratio:auto 16 / 9;', 'aspect-ratio:auto 16/9;');
         $this->assertDef('text-decoration:underline;');
         $this->assertDef('text-decoration-line:overline;');
         $this->assertDef('text-decoration-style:dashed;');