Fix HTTP analysis ignores expectedResponse #7396

docs/content/en/docs-v1.0.x/plugins/official/analysis.md

@@ -196,7 +196,7 @@ At least one of `min` or `max` is required.
 | method | string | HTTP method. | No |
 | headers | [][AnalysisHTTPHeader](#analysishttpheader) | Request headers. | No |
 | expectedCode | int | Expected HTTP status code. | No |
-| expectedResponse | string | Expected response body. | No |
+| expectedResponse | string | Expected response body. The body must match exactly, including whitespace and newlines. Leave empty to validate only the HTTP status code. | No |
 | interval | duration | How often the request is sent. | Yes |
 | failureLimit | int | Number of failed checks tolerated before the analysis fails. | No (default `0`) |
 | skipOnNoData | bool | Treat "no data returned" as a success. | No (default `false`) |

pkg/app/pipedv1/plugin/analysis/analysisprovider/http/http.go

@@ -19,15 +19,17 @@ package http
 import (
 	"context"
 	"fmt"
+	"io"
 	"net/http"
 	"time"
 
 	"github.com/pipe-cd/pipecd/pkg/app/pipedv1/plugin/analysis/config"
 )
 
 const (
-	ProviderType   = "HTTP"
-	defaultTimeout = 30 * time.Second
+	ProviderType        = "HTTP"
+	defaultTimeout      = 30 * time.Second
+	maxResponseBodySize = 1 << 20 // 1 MiB
 )
 
 type Provider struct {
@@ -49,6 +51,10 @@ func NewProvider(timeout time.Duration) *Provider {
 
 // Run sends an HTTP request and then evaluate whether the response is expected one.
 func (p *Provider) Run(ctx context.Context, cfg *config.AnalysisHTTP) (bool, string, error) {
+	if len(cfg.ExpectedResponse) > maxResponseBodySize {
+		return false, "", fmt.Errorf("expected response exceeds maximum size of %d bytes", maxResponseBodySize)
+	}
+
 	req, err := p.makeRequest(ctx, cfg)
 	if err != nil {
 		return false, "", err
@@ -63,7 +69,22 @@ func (p *Provider) Run(ctx context.Context, cfg *config.AnalysisHTTP) (bool, str
 	if res.StatusCode != cfg.ExpectedCode {
 		return false, "", fmt.Errorf("unexpected status code %d", res.StatusCode)
 	}
-	// TODO: Decide how to check if the body is expected one.
+
+	if cfg.ExpectedResponse == "" {
+		return true, "", nil
+	}
+
+	body, err := io.ReadAll(io.LimitReader(res.Body, maxResponseBodySize+1))
+	if err != nil {
+		return false, "", fmt.Errorf("failed to read response body: %w", err)
+	}
+	if len(body) > maxResponseBodySize {
+		return false, "", fmt.Errorf("response body exceeds maximum size of %d bytes", maxResponseBodySize)
+	}
+	if string(body) != cfg.ExpectedResponse {
+		return false, "", fmt.Errorf("unexpected response body")
+	}
+
 	return true, "", nil
 }
 

pkg/app/pipedv1/plugin/analysis/analysisprovider/http/http_test.go

@@ -0,0 +1,120 @@
+// Copyright 2025 The PipeCD Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package http
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	analysisconfig "github.com/pipe-cd/pipecd/pkg/app/pipedv1/plugin/analysis/config"
+)
+
+func TestProviderRun(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name             string
+		statusCode       int
+		responseBody     string
+		expectedCode     int
+		expectedResponse string
+		wantOK           bool
+		wantErr          string
+	}{
+		{
+			name:             "matching expected response",
+			statusCode:       http.StatusOK,
+			responseBody:     `{"status":"healthy"}`,
+			expectedCode:     http.StatusOK,
+			expectedResponse: `{"status":"healthy"}`,
+			wantOK:           true,
+		},
+		{
+			name:             "unexpected response body",
+			statusCode:       http.StatusOK,
+			responseBody:     `{"status":"unhealthy"}`,
+			expectedCode:     http.StatusOK,
+			expectedResponse: `{"status":"healthy"}`,
+			wantErr:          "unexpected response body",
+		},
+		{
+			name:         "empty expected response skips body validation",
+			statusCode:   http.StatusOK,
+			responseBody: "any response",
+			expectedCode: http.StatusOK,
+			wantOK:       true,
+		},
+		{
+			name:             "unexpected status code takes precedence",
+			statusCode:       http.StatusServiceUnavailable,
+			responseBody:     `{"status":"healthy"}`,
+			expectedCode:     http.StatusOK,
+			expectedResponse: `{"status":"healthy"}`,
+			wantErr:          "unexpected status code 503",
+		},
+		{
+			name:             "response body exceeds limit",
+			statusCode:       http.StatusOK,
+			responseBody:     strings.Repeat("a", maxResponseBodySize+1),
+			expectedCode:     http.StatusOK,
+			expectedResponse: "expected",
+			wantErr:          "response body exceeds maximum size of 1048576 bytes",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(tt.statusCode)
+				_, _ = w.Write([]byte(tt.responseBody))
+			}))
+			t.Cleanup(server.Close)
+
+			ok, _, err := NewProvider(0).Run(context.Background(), &analysisconfig.AnalysisHTTP{
+				URL:              server.URL,
+				Method:           http.MethodGet,
+				ExpectedCode:     tt.expectedCode,
+				ExpectedResponse: tt.expectedResponse,
+			})
+
+			assert.Equal(t, tt.wantOK, ok)
+			if tt.wantErr == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.EqualError(t, err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestProviderRunExpectedResponseExceedsLimit(t *testing.T) {
+	t.Parallel()
+
+	ok, _, err := NewProvider(0).Run(context.Background(), &analysisconfig.AnalysisHTTP{
+		URL:              "://invalid-url",
+		Method:           http.MethodGet,
+		ExpectedResponse: strings.Repeat("a", maxResponseBodySize+1),
+	})
+
+	assert.False(t, ok)
+	assert.EqualError(t, err, "expected response exceeds maximum size of 1048576 bytes")
+}

pkg/app/pipedv1/plugin/analysis/config/condition.go

@@ -158,10 +158,12 @@ type AnalysisHTTP struct {
 	URL    string `json:"url"`
 	Method string `json:"method"`
 	// Custom headers to set in the request. HTTP allows repeated headers.
-	Headers          []AnalysisHTTPHeader `json:"headers"`
-	ExpectedCode     int                  `json:"expectedCode"`
-	ExpectedResponse string               `json:"expectedResponse"`
-	Interval         unit.Duration        `json:"interval"`
+	Headers      []AnalysisHTTPHeader `json:"headers"`
+	ExpectedCode int                  `json:"expectedCode"`
+	// ExpectedResponse is the exact response body expected from the request.
+	// An empty value disables response-body validation.
+	ExpectedResponse string        `json:"expectedResponse"`
+	Interval         unit.Duration `json:"interval"`
 	// Maximum number of failed checks before the response is considered as failure.
 	FailureLimit int `json:"failureLimit"`
 	// If true, it considers as success when no data returned from the analysis provider.