Strip BOM from input JSON when found

Fixes #6988

Signed-off-by: Anders Eknert <[email protected]>

util/json.go

@@ -114,6 +114,10 @@ func Reference(x interface{}) *interface{} {
 
 // Unmarshal decodes a YAML, JSON or JSON extension value into the specified type.
 func Unmarshal(bs []byte, v interface{}) error {
+	if len(bs) > 2 && bs[0] == 0xef && bs[1] == 0xbb && bs[2] == 0xbf {
+		bs = bs[3:] // Strip UTF-8 BOM, see https://www.rfc-editor.org/rfc/rfc8259#section-8.1
+	}
+
 	if json.Valid(bs) {
 		return unmarshalJSON(bs, v, false)
 	}

util/json_test.go

@@ -122,3 +122,17 @@ func TestInvalidYAMLValidJSON(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestUnmarshalJSONUTF8BOM(t *testing.T) {
+	bomFail := []byte{0xef, 0xbb, 0xbf, 0x22, 0x5c, 0x2f, 0x22, 0x0a} // "\/" preceded by UTF-8 BOM
+
+	if json.Valid(bomFail) {
+		t.Fatal("expected invalid JSON")
+	}
+
+	var x any
+	err := util.Unmarshal(bomFail, &x)
+	if err != nil {
+		t.Fatal("expected BOM to be stripped", err)
+	}
+}