fix(misconf): check if metadata is not nil

Signed-off-by: nikpivkin <[email protected]>

Author: nikpivkin

pkg/iac/rego/load.go

@@ -197,13 +197,13 @@ func (s *Scanner) findMatchedEmbeddedCheck(badPolicy *ast.Module) *ast.Module {
 	}
 
 	badPolicyMeta, err := MetadataFromAnnotations(badPolicy)
-	if err != nil {
+	if err != nil || badPolicyMeta == nil {
 		return nil
 	}
 
 	for _, embeddedCheck := range s.embeddedChecks {
 		meta, err := MetadataFromAnnotations(embeddedCheck)
-		if err != nil {
+		if err != nil || meta == nil {
 			continue
 		}
 		if badPolicyMeta.AVDID != "" && badPolicyMeta.AVDID == meta.AVDID {

pkg/iac/rego/load_test.go

@@ -253,3 +253,18 @@ deny {
 	err := scanner.LoadPolicies(fsys)
 	require.Error(t, err)
 }
+
+func TestFallback_CheckWithoutAnnotation(t *testing.T) {
+	fsys := fstest.MapFS{
+		"check.rego": &fstest.MapFile{Data: []byte(`package builtin.test
+import data.func
+deny := func(input)
+`)},
+	}
+	scanner := rego.NewScanner(
+		rego.WithPolicyDirs("."),
+		rego.WithEmbeddedLibraries(false),
+	)
+	err := scanner.LoadPolicies(fsys)
+	require.NoError(t, err)
+}