The following code is flagged as dead (since it's *replacing* rather than updating the existing Object):
https://github.com/mozilla/pdf.js/blob/4483cba72410027acf46630ebf252ae529704476/src/core/xfa/template.js#L2336-L2339
according to the alert in https://github.com/mozilla/pdf.js/security/code-scanning/103?query=ref%3Arefs%2Fheads%2Fmaster

Looking at the surrounding code, I can see a couple of possibilities here:
 1. This is indeed just dead code, which should be removed.
 2. The code should be moved up, and placed just *above* the previous block instead.
 3. There should be other, more invasive, changes made to this code...

/cc @calixteman Which solution is correct here?
Assuming it's either option 1 or 2, I can submit a patch to fix this.
const style = toStyle("margin");
    const size = measureToString(this.size);
    style.width = style.height = size;
    let type;
    let className;
    let groupId;
    const field = this[$getParent]()[$getParent]();
    const items =
      (field.items.children.length &&
        field.items.children[0][$toHTML]().html) ||
      [];
    const exportedValue = {
      on: (items[0] || "on").toString(),
      off: (items[1] || "off").toString(),
    };
    const value = (field.value && field.value[$text]()) || "off";
    const checked = value === exportedValue.on || undefined;
    const container = field[$getSubformParent]();
    const fieldId = field[$uid];
    let dataId;
    if (container instanceof ExclGroup) {
      groupId = container[$uid];
      type = "radio";
      className = "xfaRadio";
      dataId = (container[$data] && container[$data][$uid]) || container[$uid];