From efef7d238e4fd6de3b5a2750d21604b57d8b7b93 Mon Sep 17 00:00:00 2001
From: Anders Eknert <anders@eknert.com>
Date: Wed, 4 Sep 2024 22:46:03 +0200
Subject: [PATCH] Strip BOM from input JSON when found

Fixes #6988

Signed-off-by: Anders Eknert <anders@eknert.com>
---
 util/json.go      |  4 ++++
 util/json_test.go | 14 ++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/util/json.go b/util/json.go
index 4f1e14513f..0b7fd2ed64 100644
--- a/util/json.go
+++ b/util/json.go
@@ -114,6 +114,10 @@ func Reference(x interface{}) *interface{} {
 
 // Unmarshal decodes a YAML, JSON or JSON extension value into the specified type.
 func Unmarshal(bs []byte, v interface{}) error {
+	if len(bs) > 2 && bs[0] == 0xef && bs[1] == 0xbb && bs[2] == 0xbf {
+		bs = bs[3:] // Strip UTF-8 BOM, see https://www.rfc-editor.org/rfc/rfc8259#section-8.1
+	}
+
 	if json.Valid(bs) {
 		return unmarshalJSON(bs, v, false)
 	}
diff --git a/util/json_test.go b/util/json_test.go
index 62e39b70b4..0fa9d1f9c3 100644
--- a/util/json_test.go
+++ b/util/json_test.go
@@ -122,3 +122,17 @@ func TestInvalidYAMLValidJSON(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestUnmarshalJSONUTF8BOM(t *testing.T) {
+	bomFail := []byte{0xef, 0xbb, 0xbf, 0x22, 0x5c, 0x2f, 0x22, 0x0a} // "\/" preceded by UTF-8 BOM
+
+	if json.Valid(bomFail) {
+		t.Fatal("expected invalid JSON")
+	}
+
+	var x any
+	err := util.Unmarshal(bomFail, &x)
+	if err != nil {
+		t.Fatal("expected BOM to be stripped", err)
+	}
+}