From 6daa2996eba29d492d80ebd5053d430888f95645 Mon Sep 17 00:00:00 2001
From: Dominik Schulz <dominik.schulz@gmail.com>
Date: Mon, 16 Oct 2017 14:39:29 +0200
Subject: [PATCH] Relax YAML document marker requirments (#400)

Fixes #398
---
 store/secret/secret.go    |  2 +-
 store/secret/yaml_test.go | 42 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/store/secret/secret.go b/store/secret/secret.go
index fbd624d5d2..a3c58a0553 100644
--- a/store/secret/secret.go
+++ b/store/secret/secret.go
@@ -46,7 +46,7 @@ func Parse(buf []byte) (*Secret, error) {
 
 // decodeYAML attempts to decode an optional YAML part of a secret
 func (s *Secret) decodeYAML() (bool, error) {
-	if !strings.HasPrefix(s.body, "---\n") {
+	if !strings.HasPrefix(s.body, "---\n") && s.password != "---" {
 		return false, nil
 	}
 	d := make(map[string]interface{})
diff --git a/store/secret/yaml_test.go b/store/secret/yaml_test.go
index 1e79947068..637510cabc 100644
--- a/store/secret/yaml_test.go
+++ b/store/secret/yaml_test.go
@@ -234,6 +234,48 @@ url: http://www.test.com/`
 				}
 			},
 		},
+		{
+			name: "Document Marker as Password (#398)",
+			tf: func(t *testing.T) {
+				mlValue := `---`
+				s, err := Parse([]byte(mlValue))
+				if err != nil {
+					t.Logf("%s", err)
+				}
+				if s == nil {
+					t.Fatalf("Secret is nil")
+				}
+				// read back key
+				if s.Password() != "---" {
+					t.Errorf("Secret does not match input")
+				}
+			},
+		},
+		{
+			name: "YAML Body without Password (#398)",
+			tf: func(t *testing.T) {
+				mlValue := `---
+username: myuser@test.com
+password: somepasswd
+url: http://www.test.com/`
+				s, err := Parse([]byte(mlValue))
+				if err != nil {
+					t.Logf("%s", err)
+				}
+				if s == nil {
+					t.Fatalf("Secret is nil")
+				}
+				t.Logf("Data: %+v", s.Data())
+				// read back key
+				val, err := s.Value("username")
+				if err != nil {
+					t.Fatalf("Failed to read username: %s", err)
+				}
+				if val != "myuser@test.com" {
+					t.Errorf("Decoded Secret does not match input")
+				}
+			},
+		},
 	} {
 		// run test case
 		t.Run(tc.name, tc.tf)