From c808bb14834f3e2b2c64e285eac44c9e781f8909 Mon Sep 17 00:00:00 2001
From: "Nolann B." <100787331+nolannbiron@users.noreply.github.com>
Date: Tue, 25 Feb 2025 17:27:31 +0100
Subject: [PATCH] Fallback to untrusted validation in case JSON OpenAPI spec is
 invalid (#2877)

---
 .changeset/angry-berries-fail.md  |  5 +++++
 packages/openapi-parser/src/v3.ts | 10 ++++------
 2 files changed, 9 insertions(+), 6 deletions(-)
 create mode 100644 .changeset/angry-berries-fail.md

diff --git a/.changeset/angry-berries-fail.md b/.changeset/angry-berries-fail.md
new file mode 100644
index 000000000..5375ad01d
--- /dev/null
+++ b/.changeset/angry-berries-fail.md
@@ -0,0 +1,5 @@
+---
+'@gitbook/openapi-parser': patch
+---
+
+Fallback to untrusted validation in case JSON spec is invalid
diff --git a/packages/openapi-parser/src/v3.ts b/packages/openapi-parser/src/v3.ts
index b084a81c0..5ee63bfef 100644
--- a/packages/openapi-parser/src/v3.ts
+++ b/packages/openapi-parser/src/v3.ts
@@ -14,7 +14,7 @@ export async function parseOpenAPIV3(
 ): Promise<Filesystem<OpenAPIV3xDocument>> {
     const { value, rootURL, trust } = input;
     const specification = trust
-        ? trustedValidate({ value, rootURL })
+        ? await trustedValidate({ value, rootURL })
         : await untrustedValidate({ value, rootURL });
 
     const filesystem = await createFileSystem({ value: specification, rootURL });
@@ -54,17 +54,15 @@ async function untrustedValidate(input: ValidateOpenAPIV3Input) {
  * It assumes the specification is already a valid specification.
  * It's faster than `untrustedValidate`.
  */
-function trustedValidate(input: ValidateOpenAPIV3Input) {
+async function trustedValidate(input: ValidateOpenAPIV3Input) {
     const { value, rootURL } = input;
     const result = (() => {
         if (typeof value === 'string') {
             try {
                 return JSON.parse(value);
             } catch (error) {
-                throw new OpenAPIParseError('Invalid JSON', {
-                    code: 'invalid',
-                    rootURL,
-                });
+                /** In case of an invalid JSON, we fallback to untrusted validation. */
+                return untrustedValidate(input);
             }
         }
         return value;