bridgecrewio · omriyoffe-panw · May 14, 2025 · May 14, 2025 · May 14, 2025 · May 14, 2025
diff --git a/checkov/common/checks_infra/solvers/attribute_solvers/is_empty_attribute_solver.py b/checkov/common/checks_infra/solvers/attribute_solvers/is_empty_attribute_solver.py
@@ -1,7 +1,11 @@
 from typing import Optional, Any, Dict
-from collections.abc import Sized
+from collections.abc import Collection
+
+import hcl2
+
 from checkov.common.graph.checks_infra.enums import Operators
 from checkov.common.checks_infra.solvers.attribute_solvers.base_attribute_solver import BaseAttributeSolver
+from checkov.common.util.consts import START_LINE, END_LINE
 
 
 class IsEmptyAttributeSolver(BaseAttributeSolver):
@@ -10,7 +14,10 @@ class IsEmptyAttributeSolver(BaseAttributeSolver):
     def _get_operation(self, vertex: Dict[str, Any], attribute: Optional[str]) -> bool:
         attr = vertex.get(attribute)  # type:ignore[arg-type]  # due to attribute can be None
 
-        if isinstance(attr, (list, Sized)):
-            return len(attr) == 0
+        if isinstance(attr, (list, Collection)):
+            if len(attr) == 0 \
+                    or (len(attr) == 2 and START_LINE in attr and END_LINE in attr) \
+                    or (len(attr) == 2 and hcl2.START_LINE in attr and hcl2.END_LINE in attr):
+                return True
 
         return False
diff --git a/tests/kubernetes/graph/checks/resources/IsNotEmpty/Failing/deployment.yaml b/tests/kubernetes/graph/checks/resources/IsNotEmpty/Failing/deployment.yaml
@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: failing-selector-deployment
+spec:
+  replicas: 2
+  # Intentionally leaving matchLabels empty
+  selector:
+    matchLabels: {}
+  template:
+    metadata:
+      labels:
+        app: my-failing-selector-app
+    spec:
+      containers:
+        - name: my-container
+          image: nginx:latest
+          ports:
+            - containerPort: 80
diff --git a/tests/kubernetes/graph/checks/resources/IsNotEmpty/Passing/deployment.yaml b/tests/kubernetes/graph/checks/resources/IsNotEmpty/Passing/deployment.yaml
@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: passing-selector-deployment
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: my-passing-selector-app
+  template:
+    metadata:
+      labels:
+        app: my-passing-selector-app
+    spec:
+      containers:
+        - name: my-container
+          image: nginx:latest
+          ports:
+            - containerPort: 80
diff --git a/tests/kubernetes/graph/checks/resources/IsNotEmpty/expected.yaml b/tests/kubernetes/graph/checks/resources/IsNotEmpty/expected.yaml
@@ -0,0 +1,4 @@
+pass:
+  - "Deployment.default.passing-selector-deployment"
+fail:
+  - "Deployment.default.failing-selector-deployment"
diff --git a/tests/kubernetes/graph/checks/test_checks/IsNotEmpty.yaml b/tests/kubernetes/graph/checks/test_checks/IsNotEmpty.yaml
@@ -0,0 +1,12 @@
+metadata:
+  name: "Missing or empty containers in K8S Deployment"
+  id: "NOT_EMPTY_01"
+  category: "KUBERNETES"
+scope:
+  provider: kubernetes
+  definition:
+    cond_type: "attribute"
+    resource_types:
+      - "Deployment"
+    attribute: "spec.selector.matchLabels"
+    operator: "is_not_empty"