guard against .bak/.pre-/.orig/.swp/~ url junk

efd0670b6eb0dd367171b687b82c3f1cc3563cb7 · 2026-05-19 18:39:17 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit efd0670b6eb0dd367171b687b82c3f1cc3563cb7
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 18:39:17 2026 -0700

    guard against .bak/.pre-/.orig/.swp/~ url junk
---
 server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server.js b/server.js
index 969a923..22b4d60 100644
--- a/server.js
+++ b/server.js
@@ -27,6 +27,14 @@ const safe = (p, sql, params) => p.query(sql, params).catch(e => ({ _err: e.mess
 const app  = express();
 app.use(express.json());
 
+// 404-guard: never serve editor/backup junk even if a static mount lands here later.
+app.use((req, _res, next) => {
+  if (/\.(bak|orig|rej|swp|swo)(\.|$)|\.pre-|~$/i.test(req.path)) {
+    const err = new Error('not found'); err.status = 404; return next(err);
+  }
+  next();
+});
+
 // ── /api/sources ──────────────────────────────────────────────────────
 // Tree of selectable data sources for the left rail.
 app.get('/api/sources', async (_req, res) => {

← 2537670 ignore backup/editor junk patterns · back to 4square Admin · add noreferrer to all target=_blank links f9ab3a8 →