Aborting query-eval if the compiler has errors

Fixes: open-policy-agent#5947
Signed-off-by: Johan Fylling <[email protected]>

topdown/query.go

@@ -471,6 +471,14 @@ func (q *Query) Run(ctx context.Context) (QueryResultSet, error) {
 // Iter executes the query and invokes the iter function with query results
 // produced by evaluating the query.
 func (q *Query) Iter(ctx context.Context, iter func(QueryResult) error) error {
+	// Query evaluation must not be allowed if the compiler has errors and is in an undefined, possibly inconsistent state
+	if q.compiler != nil && len(q.compiler.Errors) > 0 {
+		return &Error{
+			Code:    InternalErr,
+			Message: "compiler has errors",
+		}
+	}
+
 	if q.seed == nil {
 		q.seed = rand.Reader
 	}

topdown/query_test.go

@@ -7,6 +7,7 @@ package topdown
 import (
 	"context"
 	"reflect"
+	"strings"
 	"testing"
 
 	"github.com/open-policy-agent/opa/ast"
@@ -214,6 +215,35 @@ func TestRegoMetadataBuiltinCall(t *testing.T) {
 	}
 }
 
+func TestWithCompilerErrors(t *testing.T) {
+	store := inmem.New()
+	ctx := context.Background()
+	txn := storage.NewTransactionOrDie(ctx, store)
+	defer store.Abort(ctx, txn)
+
+	// Policy with reference to non-existing function
+	modules := map[string]*ast.Module{
+		"tst": ast.MustParseModule(`package test
+p := data.q(42)`),
+	}
+
+	c := ast.NewCompiler()
+	c.Compile(modules)
+	q := NewQuery(ast.MustParseBody("data.a = 1")).
+		WithCompiler(c).
+		WithStore(store).
+		WithTransaction(txn)
+
+	_, err := q.Run(context.Background())
+	if err == nil {
+		t.Fatalf("expected error, got nil")
+	}
+	expected := "eval_internal_error: compiler has errors"
+	if !strings.Contains(err.Error(), expected) {
+		t.Fatalf("expected error to contain '%s', got: %v", expected, err)
+	}
+}
+
 func initTracerTestQuery() *Query {
 	ctx := context.Background()
 	store := inmem.New()