jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution

@@ -30,6 +30,23 @@ var pdfUnescape = function(value) {
     .replace(/\\\)/g, ")");
 };
 
+/**
+ * Escapes a PDF Name Object.
+ * Replaces special characters (delimiter, whitespace, #) with their hex representation.
+ */
+var pdfEscapeName = function(value) {
+  return value
+    .toString()
+    .replace(/#/g, "#23")
+    .replace(/[\s\n\r()<>[\]{}\/%]/g, c => {
+      const hex = c
+        .charCodeAt(0)
+        .toString(16)
+        .toUpperCase();
+      return "#" + (hex.length === 1 ? "0" + hex : hex);
+    });
+};
+
 var f2 = function(number) {
   return number.toFixed(2); // Ie, %.2f
 };
@@ -742,12 +759,12 @@ var arrayToPdfArray = (jsPDFAPI.__acroform__.arrayToPdfArray = function(
           content += array[i].toString();
           break;
         case "string":
-          if (array[i].substr(0, 1) !== "/") {
+          if (array[i].substr(0, 1) === "/") {
+            content += "/" + pdfEscapeName(array[i].substr(1));
+          } else {
             if (typeof objId !== "undefined" && scope)
               encryptor = scope.internal.getEncryptor(objId);
             content += "(" + pdfEscape(encryptor(array[i].toString())) + ")";
-          } else {
-            content += array[i].toString();
           }
           break;
       }
@@ -759,6 +776,7 @@ var arrayToPdfArray = (jsPDFAPI.__acroform__.arrayToPdfArray = function(
     "Invalid argument passed to jsPDF.__acroform__.arrayToPdfArray"
   );
 });
+
 function getMatches(string, regex, index) {
   index || (index = 1); // default to the first capturing group
   var matches = [];
@@ -1394,7 +1412,7 @@ var AcroFormField = function() {
     set: function(value) {
       value = value.toString();
       if (this instanceof AcroFormButton === true) {
-        _DV = "/" + value;
+        _DV = "/" + pdfEscapeName(value);
       } else {
         _DV = value;
       }
@@ -1461,7 +1479,7 @@ var AcroFormField = function() {
     set: function(value) {
       value = value.toString();
       if (this instanceof AcroFormButton === true) {
-        _V = "/" + value;
+        _V = "/" + pdfEscapeName(value);
       } else {
         _V = value;
       }
@@ -2142,7 +2160,7 @@ var AcroFormButton = function() {
       return _AS.substr(1, _AS.length - 1);
     },
     set: function(value) {
-      _AS = "/" + value;
+      _AS = "/" + pdfEscapeName(value);
     }
   });
 };

@@ -214,7 +214,7 @@ describe("Module: Acroform Unit Test", function() {
 
   it("AcroFormField defaultValue", function() {
     var formObject = new TextField();
-    
+
     formObject.defaultValue = "test1";
     expect(formObject.defaultValue).toEqual("test1");
     expect(formObject.DV).toEqual("(test1)");
@@ -447,7 +447,7 @@ describe("Module: Acroform Unit Test", function() {
     field = new TextField();
     expect(field.Ff).toEqual(0);
 
-    field = new TextField();    
+    field = new TextField();
     expect(field.Ff).toEqual(0);
     expect(field.readOnly).toEqual(false);
     field.readOnly = true;
@@ -1116,4 +1116,51 @@ describe("Module: Acroform Integration Test", function() {
     expect(jsPDF.API.AcroFormRadioButton);
     expect(jsPDF.API.AcroFormTextField);
   });
+  describe("Security: PDF Injection Prevention", function() {
+    it("should escape malicious characters in ChoiceField options", function() {
+      const doc = new jsPDF();
+      const field = new doc.AcroFormChoiceField();
+      const maliciousInput = "/dummy] /AA << /JS (app.alert(1)) >> [";
+
+      field.addOption(maliciousInput);
+      doc.addField(field);
+
+      const output = doc.output();
+
+      expect(output).not.toContain("/dummy]");
+      expect(output).toContain("/dummy#5D");
+    });
+
+    it("should escape appearanceState in CheckBox", function() {
+      const doc = new jsPDF();
+      const field = new doc.AcroFormCheckBox();
+      field.x = 0;
+      field.y = 0;
+      field.width = 10;
+      field.height = 10;
+      const maliciousInput = "Off /AA << >>";
+
+      field.appearanceState = maliciousInput;
+      doc.addField(field);
+
+      const output = doc.output();
+
+      expect(output).not.toContain("/AA <<");
+      expect(output).toContain("#2FAA");
+    });
+
+    it("should escape appearanceState in RadioButton", function() {
+      const doc = new jsPDF();
+      const field = new doc.AcroFormRadioButton();
+      const maliciousInput = "Off /AA << >>";
+
+      field.appearanceState = maliciousInput;
+      doc.addField(field);
+
+      const output = doc.output();
+
+      expect(output).not.toContain("/AA <<");
+      expect(output).toContain("#2FAA");
+    });
+  });
 });