From 9246871b8b0c7cc0706fba7707df5b94c0dca065 Mon Sep 17 00:00:00 2001
From: Joeseph Grey <212606152+StressTestor@users.noreply.github.com>
Date: Sun, 2 Aug 2026 19:29:33 -0600
Subject: [PATCH] fix: skip UTF-8 BOM when processing front matter (#2751)

* fix: skip UTF-8 BOM when processing front matter

--front-matter=process wrapped the file in a bufio.Reader without
skipping a leading UTF-8 BOM, so a BOM before the opening --- meant the
separator was not recognised and the opening --- was dropped from the
output (data loss). Skip the BOM with utfbom.Skip before wrapping the
reader, matching the CSV object decoder.

* refactor: inline UTF-8 BOM skip instead of utfbom dependency

per ccoVeille's review, front matter only needs UTF-8 BOM handling, not
the full utfbom package. replace utfbom.Skip with a small unexported
stripUTF8BOM helper and add a stdin-path regression test alongside the
existing file-path one. utfbom stays in go.mod since decoder_csv_object.go
still uses it for CSV decoding.
---
 pkg/yqlib/front_matter.go      | 19 +++++++-
 pkg/yqlib/front_matter_test.go | 86 ++++++++++++++++++++++++++++++++++
 2 files changed, 103 insertions(+), 2 deletions(-)

diff --git a/pkg/yqlib/front_matter.go b/pkg/yqlib/front_matter.go
index 4c56aabd..0f9efb26 100644
--- a/pkg/yqlib/front_matter.go
+++ b/pkg/yqlib/front_matter.go
@@ -2,11 +2,26 @@ package yqlib
 
 import (
 	"bufio"
+	"bytes"
 	"errors"
 	"io"
 	"os"
 )
 
+var utf8BOM = []byte{0xEF, 0xBB, 0xBF}
+
+// stripUTF8BOM returns a reader that skips a leading UTF-8 BOM, if present.
+func stripUTF8BOM(r io.Reader) io.Reader {
+	br := bufio.NewReader(r)
+
+	peek, err := br.Peek(3)
+	if err == nil && bytes.Equal(peek, utf8BOM) {
+		_, _ = br.Discard(3)
+	}
+
+	return br
+}
+
 type frontMatterHandler interface {
 	Split() error
 	GetYamlFrontMatterFilename() string
@@ -43,13 +58,13 @@ func (f *frontMatterHandlerImpl) Split() error {
 	var reader *bufio.Reader
 	var err error
 	if f.originalFilename == "-" {
-		reader = bufio.NewReader(os.Stdin)
+		reader = bufio.NewReader(stripUTF8BOM(os.Stdin))
 	} else {
 		file, err := os.Open(f.originalFilename) // #nosec
 		if err != nil {
 			return err
 		}
-		reader = bufio.NewReader(file)
+		reader = bufio.NewReader(stripUTF8BOM(file))
 	}
 	f.contentReader = reader
 
diff --git a/pkg/yqlib/front_matter_test.go b/pkg/yqlib/front_matter_test.go
index 65c17c50..2680aa28 100644
--- a/pkg/yqlib/front_matter_test.go
+++ b/pkg/yqlib/front_matter_test.go
@@ -157,6 +157,92 @@ Some content
 	fmHandler.CleanUp()
 }
 
+func TestFrontMatterSplitWithBOM(t *testing.T) {
+	// Regression test for https://github.com/mikefarah/yq/issues/2496
+	// A UTF-8 BOM before the opening --- must be skipped, otherwise the
+	// separator isn't recognised and the opening --- is lost.
+	file := createTestFile("\ufeff---\na: apple\nb: banana\n---\nnot a\nyaml: doc\n")
+
+	expectedYamlFm := `---
+a: apple
+b: banana
+`
+
+	expectedContent := `---
+not a
+yaml: doc
+`
+
+	fmHandler := NewFrontMatterHandler(file)
+	err := fmHandler.Split()
+	if err != nil {
+		panic(err)
+	}
+
+	yamlFm := readFile(fmHandler.GetYamlFrontMatterFilename())
+
+	test.AssertResult(t, expectedYamlFm, yamlFm)
+
+	contentBytes, err := io.ReadAll(fmHandler.GetContentReader())
+	if err != nil {
+		panic(err)
+	}
+	test.AssertResult(t, expectedContent, string(contentBytes))
+
+	tryRemoveTempFile(file)
+	fmHandler.CleanUp()
+}
+
+func TestFrontMatterSplitWithBOMFromStdin(t *testing.T) {
+	// Regression test for https://github.com/mikefarah/yq/issues/2496
+	// A UTF-8 BOM must also be skipped when reading front matter from stdin.
+	originalStdin := os.Stdin
+	defer func() { os.Stdin = originalStdin }()
+
+	r, w, err := os.Pipe()
+	if err != nil {
+		panic(err)
+	}
+	os.Stdin = r
+	defer safelyCloseFile(r)
+
+	go func() {
+		_, writeErr := w.WriteString("\ufeff---\na: apple\nb: banana\n---\nnot a\nyaml: doc\n")
+		if writeErr != nil {
+			t.Errorf("failed to write front matter to the stdin pipe: %v", writeErr)
+		}
+		safelyCloseFile(w)
+	}()
+
+	expectedYamlFm := `---
+a: apple
+b: banana
+`
+
+	expectedContent := `---
+not a
+yaml: doc
+`
+
+	fmHandler := NewFrontMatterHandler("-")
+	err = fmHandler.Split()
+	if err != nil {
+		panic(err)
+	}
+
+	yamlFm := readFile(fmHandler.GetYamlFrontMatterFilename())
+
+	test.AssertResult(t, expectedYamlFm, yamlFm)
+
+	contentBytes, err := io.ReadAll(fmHandler.GetContentReader())
+	if err != nil {
+		panic(err)
+	}
+	test.AssertResult(t, expectedContent, string(contentBytes))
+
+	fmHandler.CleanUp()
+}
+
 func TestFrontMatterSplitWithArray(t *testing.T) {
 	file := createTestFile(`[1,2,3]
 ---