guard static root against .bak/.pre-* snapshot paths

c834d761be07daa3e1665a25bfad8dd400547283 · 2026-05-19 17:21:40 -0700 · SteveStudio2

Express middleware returns 404 for any URL matching .bak/.pre-* before
hitting express.static. Belt-and-suspenders even though no snapshot
files currently land in public/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit c834d761be07daa3e1665a25bfad8dd400547283
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 17:21:40 2026 -0700

    guard static root against .bak/.pre-* snapshot paths
    
    Express middleware returns 404 for any URL matching .bak/.pre-* before
    hitting express.static. Belt-and-suspenders even though no snapshot
    files currently land in public/.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server.js b/server.js
index f5c13f1..315f15e 100644
--- a/server.js
+++ b/server.js
@@ -334,6 +334,16 @@ app.get('/api/all-hero-grids', async (req, res) => {
   res.json({ ok: true, count: out.length, sites: out, ts: Date.now() });
 });
 
+// ── 404-guard: never serve snapshot files (.bak / .bak.* / .pre-*) ───────
+// Belt-and-suspenders even if such files never land in public/ — keeps
+// accidental backups from being publicly served if a deploy ever drops one.
+app.use((req, res, next) => {
+  if (/(\.bak(\.|$)|\.pre-)/i.test(req.path)) {
+    return res.status(404).send('Not found');
+  }
+  next();
+});
+
 // ── Static frontend ───────────────────────────────────────────────────────
 app.use(express.static(path.join(__dirname, 'public'), { extensions: ['html'] }));

← 75729fd add rel=noreferrer to external target=_blank links · back to 4square Agentabrams · gitignore: exclude *.bak / *.bak.* / *.pre-* snapshots 753da98 →