From e5c8456c693a16e365b440c34f467ca61572316d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Afonso=20Janu=C3=A1rio?= <afonso-januario@hotmail.com>
Date: Thu, 10 Sep 2026 13:45:37 +0100
Subject: [PATCH] Reject negative lengths for border-spacing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CSS Tables spec defines border-spacing as <length [0,∞]>{1,2} and
says the values "must be non-negative". Every sibling length property
in this codebase that has the same constraint (border-width, padding,
width, height, line-height, flex-grow/shrink) passes min: 0 into
resolveNumericValue, but borderSpacing.js never did, so a negative
length was happily accepted and stored:

  style.borderSpacing = '-10px';
  style.borderSpacing; // '-10px', should be rejected

This adds the missing min: 0 to both the single-value and two-value
branches of the parser, matching how the rest of the codebase handles
non-negative lengths, and adds three tests covering a single negative
value and a negative value in either position of a two-value pair.

Co-authored-by: Claude <noreply@anthropic.com>
---
 lib/properties/borderSpacing.js |  9 ++++++---
 test/properties.test.js         | 12 ++++++++++++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/lib/properties/borderSpacing.js b/lib/properties/borderSpacing.js
index ec72477b..a77b7434 100644
--- a/lib/properties/borderSpacing.js
+++ b/lib/properties/borderSpacing.js
@@ -39,16 +39,19 @@ function parse(v) {
     switch (value.length) {
       case 1: {
         return parsers.resolveNumericValue(value, {
-          type: "length"
+          type: "length",
+          min: 0
         });
       }
       case 2: {
         const [part1, part2] = value;
         const val1 = parsers.resolveNumericValue([part1], {
-          type: "length"
+          type: "length",
+          min: 0
         });
         const val2 = parsers.resolveNumericValue([part2], {
-          type: "length"
+          type: "length",
+          min: 0
         });
         if (val1 && val2) {
           return `${val1} ${val2}`;
diff --git a/test/properties.test.js b/test/properties.test.js
index da9a45f3..f21dd674 100644
--- a/test/properties.test.js
+++ b/test/properties.test.js
@@ -771,6 +771,18 @@ describe("border", () => {
     testPropertyValue("border-spacing", "10px 20px", "10px 20px");
   });
 
+  it("border-spacing should not set / get negative length", () => {
+    testPropertyValue("border-spacing", "-10px", "");
+  });
+
+  it("border-spacing should not set / get negative length as the first of two values", () => {
+    testPropertyValue("border-spacing", "-10px 20px", "");
+  });
+
+  it("border-spacing should not set / get negative length as the second of two values", () => {
+    testPropertyValue("border-spacing", "10px -20px", "");
+  });
+
   it("border-top shorthand should set / get value", () => {
     testImplicitPropertyValue(
       "border-top",