Merge commit from fork

* fix

* fix

* add regression tests and revert dist changes

* prettier

---------

Co-authored-by: Lukas Holländer <lukas.hollaender@yworks.com>

Author: Macabely

src/modules/acroform.js

@@ -2143,7 +2143,11 @@ var AcroFormButton = function() {
       return _AS;
     },
     set: function(value) {
-      _AS = value;
+      var name = value === undefined || value === null ? "" : value.toString();
+      if (name.substr(0, 1) === "/") {
+        name = name.substr(1);
+      }
+      _AS = "/" + pdfEscapeName(name);
     }
   });
 
@@ -2296,7 +2300,11 @@ var AcroFormChildClass = function() {
       return _AS;
     },
     set: function(value) {
-      _AS = value;
+      var name = value === undefined || value === null ? "" : value.toString();
+      if (name.substr(0, 1) === "/") {
+        name = name.substr(1);
+      }
+      _AS = "/" + pdfEscapeName(name);
     }
   });
 
@@ -2313,7 +2321,11 @@ var AcroFormChildClass = function() {
       return _AS.substr(1, _AS.length - 1);
     },
     set: function(value) {
-      _AS = "/" + value;
+      var name = value === undefined || value === null ? "" : value.toString();
+      if (name.substr(0, 1) === "/") {
+        name = name.substr(1);
+      }
+      _AS = "/" + pdfEscapeName(name);
     }
   });
   this.caption = "l";

test/specs/acroform.spec.js

@@ -1162,5 +1162,32 @@ describe("Module: Acroform Integration Test", function() {
       expect(output).not.toContain("/AA <<");
       expect(output).toContain("#2FAA");
     });
+    it("escapes malicious input in CheckBox AS", function() {
+      var doc = new jsPDF();
+      var field = new doc.AcroFormCheckBox();
+      field.x = 10; field.y = 10; field.width = 20; field.height = 10;
+      doc.addField(field);
+
+      field.AS = "/Off /AA << /E << /S /JavaScript /JS (app.alert(1)) >> >>";
+
+      var output = doc.output();
+      expect(output).not.toContain("/AA << /E << /S /JavaScript");
+      expect(field.AS).toContain("#2FAA");
+    });
+
+    it("escapes malicious input in RadioButton child appearanceState", function() {
+      var doc = new jsPDF();
+      var group = new doc.AcroFormRadioButton();
+      group.x = 10; group.y = 10; group.width = 20; group.height = 10;
+      doc.addField(group);
+
+      var child = group.createOption("opt1");
+      child.x = 10; child.y = 10; child.width = 20; child.height = 10;
+      child.appearanceState = "Off /AA << /E << /S /JavaScript /JS (app.alert(1)) >> >>";
+
+      var output = doc.output();
+      expect(output).not.toContain("/AA << /E << /S /JavaScript");
+      expect(child.AS).toContain("#2FAA");
+    });
   });
 });