From 2cd6f3e36b2b4e6e7ebc5ba2d31780548802cc1b Mon Sep 17 00:00:00 2001
From: Thorsten de Buhr <thorsten.deBuhr@arm.com>
Date: Thu, 22 Oct 2026 14:18:39 +0200
Subject: [PATCH] chore(codeql): annotate intentional XML reader switches

---
 .github/workflows/codeql-analysis.yml | 13 ++++++++++++-
 libs/xmlreader/src/XML_Reader.cpp     |  5 +++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 98ebffe7b..9629a8dd3 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -66,7 +66,7 @@ jobs:
           output: sarif-results
           upload: never
 
-      - name: Filter external results and SVDConv source suppressions
+      - name: Filter external results and approved source suppressions
         run: |
           set -euo pipefail
           mkdir sarif-results-filtered
@@ -84,6 +84,16 @@ jobs:
                 and any(.suppressions[]?;
                   .kind == "inSource" and ((.status // "accepted") == "accepted")
                 );
+              def is_xmlreader_trivial_switch_suppression:
+                .ruleId == "cpp/trivial-switch"
+                and (
+                  (.locations[0].physicalLocation.artifactLocation.uri // "")
+                  | gsub("\\\\"; "/")
+                  | test("^(\\./)?libs/xmlreader/src/XML_Reader\\.cpp$")
+                )
+                and any(.suppressions[]?;
+                  .kind == "inSource" and ((.status // "accepted") == "accepted")
+                );
               .runs |= map(
                 .results |= map(
                   select(
@@ -92,6 +102,7 @@ jobs:
                     | not
                   )
                   | select(is_svdconv_unused_suppression | not)
+                  | select(is_xmlreader_trivial_switch_suppression | not)
                 )
               )
             ' "$sarif_file" > "sarif-results-filtered/$(basename "$sarif_file")"
diff --git a/libs/xmlreader/src/XML_Reader.cpp b/libs/xmlreader/src/XML_Reader.cpp
index 3ce1f35ac..d03dcfc52 100644
--- a/libs/xmlreader/src/XML_Reader.cpp
+++ b/libs/xmlreader/src/XML_Reader.cpp
@@ -400,10 +400,13 @@ UTFCode XML_Reader::CheckUTF(const string& text)
   const char* str = text.c_str();
 
   UTFCode utfDetected = UTFCode::UTF_NULL;
+  // Keep the byte-decoding switch structure extensible for additional BOM variants.
   switch (*str++) {
     case (char)0xEF: {
+      // codeql[cpp/trivial-switch]
       switch (*str++) {
         case (char)0xBB: {
+          // codeql[cpp/trivial-switch]
           switch (*str++) {
             case (char)0xBF: {
               utfDetected = UTFCode::UTF8;
@@ -418,6 +421,7 @@ UTFCode XML_Reader::CheckUTF(const string& text)
     } break;
 
     case (char)0xFE: {
+      // codeql[cpp/trivial-switch]
       switch (*str++) {
         case (char)0xFF: {
           utfDetected = UTFCode::UTF16_BE;
@@ -428,6 +432,7 @@ UTFCode XML_Reader::CheckUTF(const string& text)
     } break;
 
     case (char)0xFF: {
+      // codeql[cpp/trivial-switch]
       switch (*str++) {
         case (char)0xFE: {
           utfDetected = UTFCode::UTF16_LE;