fix(misconf): check if metadata is not nil (#8647)

Signed-off-by: nikpivkin <[email protected]>

Author: nikpivkin

pkg/iac/rego/load.go

@@ -197,13 +197,13 @@ func (s *Scanner) findMatchedEmbeddedCheck(badPolicy *ast.Module) *ast.Module {
 	}
 
 	badPolicyMeta, err := MetadataFromAnnotations(badPolicy)
-	if err != nil {
+	if err != nil || badPolicyMeta == nil {
 		return nil
 	}
 
 	for _, embeddedCheck := range s.embeddedChecks {
 		meta, err := MetadataFromAnnotations(embeddedCheck)
-		if err != nil {
+		if err != nil || meta == nil {
 			continue
 		}
 		if badPolicyMeta.AVDID != "" && badPolicyMeta.AVDID == meta.AVDID {

pkg/iac/rego/load_test.go

@@ -205,7 +205,11 @@ deny {
 					}`),
 			}
 
+			originalFS := checks.EmbeddedPolicyFileSystem
 			checks.EmbeddedPolicyFileSystem = embeddedChecksFS
+			t.Cleanup(func() {
+				checks.EmbeddedPolicyFileSystem = originalFS
+			})
 			err := scanner.LoadPolicies(fstest.MapFS(tt.files))
 
 			if tt.expectedErr != "" {
@@ -253,3 +257,19 @@ deny {
 	err := scanner.LoadPolicies(fsys)
 	require.Error(t, err)
 }
+
+func TestFallback_CheckWithoutAnnotation(t *testing.T) {
+	fsys := fstest.MapFS{
+		"check.rego": &fstest.MapFile{Data: []byte(`package builtin.test
+import data.some_func
+deny := some_func(input)
+`)},
+	}
+	scanner := rego.NewScanner(
+		rego.WithPolicyDirs("."),
+		rego.WithEmbeddedLibraries(false),
+		rego.WithPolicyFilesystem(fsys),
+	)
+	err := scanner.LoadPolicies(nil)
+	require.NoError(t, err)
+}