refactor(appsec): prefer optional chaining over guard expressions (#7621)

CarlesDD · web-flow · commit 73184511d52f · 2026-02-26T09:31:30.000+01:00
diff --git a/packages/dd-trace/src/appsec/iast/analyzers/cookie-analyzer.js b/packages/dd-trace/src/appsec/iast/analyzers/cookie-analyzer.js
@@ -39,7 +39,7 @@ class CookieAnalyzer extends Analyzer {
   }
 
   _checkOCE (context, value) {
-    if (value && value.location) {
+    if (value?.location) {
       return true
     }
     return super._checkOCE(context, value)
diff --git a/packages/dd-trace/src/appsec/iast/analyzers/ssrf-analyzer.js b/packages/dd-trace/src/appsec/iast/analyzers/ssrf-analyzer.js
@@ -12,7 +12,7 @@ class SSRFAnalyzer extends InjectionAnalyzer {
     this.addSub('apm:http:client:request:start', ({ args }) => {
       if (typeof args.originalUrl === 'string') {
         this.analyze(args.originalUrl)
-      } else if (args.options && args.options.host) {
+      } else if (args.options?.host) {
         this.analyze(args.options.host)
       }
     })
diff --git a/packages/dd-trace/src/appsec/iast/analyzers/unvalidated-redirect-analyzer.js b/packages/dd-trace/src/appsec/iast/analyzers/unvalidated-redirect-analyzer.js
@@ -36,7 +36,7 @@ class UnvalidatedRedirectAnalyzer extends InjectionAnalyzer {
   }
 
   isLocationHeader (name) {
-    return name && name.trim().toLowerCase() === 'location'
+    return name?.trim().toLowerCase() === 'location'
   }
 
   _isVulnerable (value, iastContext) {
diff --git a/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/command-sensitive-analyzer.js b/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/command-sensitive-analyzer.js
@@ -10,7 +10,7 @@ module.exports = function extractSensitiveRanges (evidence) {
     pattern.lastIndex = 0
 
     const regexResult = pattern.exec(evidence.value)
-    if (regexResult && regexResult.length > 1) {
+    if (regexResult?.length > 1) {
       const start = regexResult.index + (regexResult[0].length - regexResult[1].length)
       const end = start + regexResult[1].length
       return [{ start, end }]

Original file line number	Diff line number	Diff line change
`@@ -39,7 +39,7 @@ class CookieAnalyzer extends Analyzer {`
`39`	`39`	`}`
`40`	`40`
`41`	`41`	`_checkOCE (context, value) {`
`42`		`- if (value && value.location) {`
	`42`	`+ if (value?.location) {`
`43`	`43`	`return true`
`44`	`44`	`}`
`45`	`45`	`return super._checkOCE(context, value)`
Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ class SSRFAnalyzer extends InjectionAnalyzer {`
`12`	`12`	`this.addSub('apm:http:client:request:start', ({ args }) => {`
`13`	`13`	`if (typeof args.originalUrl === 'string') {`
`14`	`14`	`this.analyze(args.originalUrl)`
`15`		`- } else if (args.options && args.options.host) {`
	`15`	`+ } else if (args.options?.host) {`
`16`	`16`	`this.analyze(args.options.host)`
`17`	`17`	`}`
`18`	`18`	`})`
Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,7 @@ class UnvalidatedRedirectAnalyzer extends InjectionAnalyzer {`
`36`	`36`	`}`
`37`	`37`
`38`	`38`	`isLocationHeader (name) {`
`39`		`- return name && name.trim().toLowerCase() === 'location'`
	`39`	`+ return name?.trim().toLowerCase() === 'location'`
`40`	`40`	`}`
`41`	`41`
`42`	`42`	`_isVulnerable (value, iastContext) {`