404-guard for .bak/.pre-* paths + broaden .gitignore

7468c96b59f47a46052c2ad5d1f50054d9ef19fb · 2026-05-19 17:23:38 -0700 · SteveStudio2

Defensive: even though no snapshot files exist in public/ today, mount
an Express middleware before the static-serve so any future *.bak or
*.pre-* files leaked into public/ return 404 instead of leaking source.
Also broaden .gitignore to keep snapshot files out of the repo.

Regex tested against 10 cases — only the targeted patterns match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 7468c96b59f47a46052c2ad5d1f50054d9ef19fb
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 17:23:38 2026 -0700

    404-guard for .bak/.pre-* paths + broaden .gitignore
    
    Defensive: even though no snapshot files exist in public/ today, mount
    an Express middleware before the static-serve so any future *.bak or
    *.pre-* files leaked into public/ return 404 instead of leaking source.
    Also broaden .gitignore to keep snapshot files out of the repo.
    
    Regex tested against 10 cases — only the targeted patterns match.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore |  5 +++++
 server.js  | 11 +++++++++++
 2 files changed, 16 insertions(+)

diff --git a/.gitignore b/.gitignore
index 4a0b3ea0..0cc9dea5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,8 @@ tmp/
 dist/
 build/
 .next/
+
+# snapshot/backup files — never commit, never serve
+*.bak
+*.bak.*
+*.pre-*
diff --git a/server.js b/server.js
index 9a82238d..0f8d1093 100644
--- a/server.js
+++ b/server.js
@@ -25,6 +25,17 @@ for (const f of [BUILD_LOG, WALL_FILE, LEADS_FILE]) if (!fs.existsSync(f)) fs.wr
 const app = express();
 app.use(express.json({ limit: '1mb' }));
 app.use(express.urlencoded({ extended: true }));
+
+// 404-guard — never serve snapshot/backup files even if they leak into public/
+// Blocks any path segment ending in .bak, .bak.<anything>, or containing .pre-
+app.use((req, res, next) => {
+  const p = req.path || '';
+  if (/(?:^|\/)[^/]*\.(?:bak(?:\.[^/]*)?|pre-[^/]*)(?:$|\/)/i.test(p)) {
+    return res.status(404).type('text/plain').send('Not Found');
+  }
+  next();
+});
+
 app.use('/static', express.static(path.join(ROOT, 'public')));
 // also serve public/*.html at root (so /digest-latest.html, /favicon.ico, etc. resolve)
 app.use(express.static(path.join(ROOT, 'public'), { extensions: ['html'] }));

← d2d61bc0 persist terminal market sort/group controls to localStorage · back to Abrams · ideas page: multi-column grid (newest leftmost) — was vertic b033d679 →