The following new code scanning alerts showed up recently:

- https://github.com/mozilla/pdf.js/security/code-scanning/402
- https://github.com/mozilla/pdf.js/security/code-scanning/401
- https://github.com/mozilla/pdf.js/security/code-scanning/400
- https://github.com/mozilla/pdf.js/security/code-scanning/399
- https://github.com/mozilla/pdf.js/security/code-scanning/398

There is a note in there that this is debugging code code, and it's indeed not called from anywhere. It has also mostly been changed 12 years ago.

@Snuffleupagus What do you think? Should we get rid of it, or is this something you have used or think is useful to keep? In the latter case we can just silence the alert.
var format = aStream.getByte();
  var count = aCharstrings.length - 1;
  var i, sid;
  if (format === 0) {
    charset['.notdef'] = readCharstringEncoding(aCharstrings[0]);
    for (i = 1; i < count + 1; i++) {
      sid = aStream.getByte() << 8 | aStream.getByte();
      charset[CFFStrings[sid]] = readCharstringEncoding(aCharstrings[i]);
    }
  } else if (format === 1) {
    for (i = 1; i < count + 1; i++) {
      var first = aStream.getByte();
      first = (first << 8) | aStream.getByte();
      var numLeft = aStream.getByte();
      for (var j = 0; j <= numLeft; j++) {
        sid = first++;
        charset[CFFStrings[sid]] = readCharstringEncoding(aCharstrings[j]);
      }
    }
  } else {
    throw new FormatError('Invalid charset format');
  }
  return charset;
}
/*
 * Take a Type2 binary charstring as input and transform it to a human
 * readable representation as specified by the 'The Type 2 Charstring Format',
 * chapter 3.1.
 */
function readCharstringEncoding(aString) {