404-guard: also block .orig .rej .swp .swo and ~-suffixed paths

a124b9156bc55606a79c70ce07bd8565c41e6531 · 2026-05-19 18:39:35 -0700 · SteveStudio2

Files touched

M server.js

Diff

commit a124b9156bc55606a79c70ce07bd8565c41e6531
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 18:39:35 2026 -0700

    404-guard: also block .orig .rej .swp .swo and ~-suffixed paths
---
 server.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/server.js b/server.js
index 0f8d1093..5067d16f 100644
--- a/server.js
+++ b/server.js
@@ -26,11 +26,12 @@ const app = express();
 app.use(express.json({ limit: '1mb' }));
 app.use(express.urlencoded({ extended: true }));
 
-// 404-guard — never serve snapshot/backup files even if they leak into public/
-// Blocks any path segment ending in .bak, .bak.<anything>, or containing .pre-
+// 404-guard — never serve snapshot/backup/editor files even if they leak into public/
+// Blocks paths ending in .bak, .bak.<x>, .pre-<x>, .orig, .rej, .swp, .swo, or ~
 app.use((req, res, next) => {
   const p = req.path || '';
-  if (/(?:^|\/)[^/]*\.(?:bak(?:\.[^/]*)?|pre-[^/]*)(?:$|\/)/i.test(p)) {
+  if (/(?:^|\/)[^/]*\.(?:bak(?:\.[^/]*)?|pre-[^/]*|orig|rej|swp|swo)(?:$|\/)/i.test(p)
+      || /~(?:$|\/)/.test(p)) {
     return res.status(404).type('text/plain').send('Not Found');
   }
   next();

← 64e23995 gitignore: add .orig .rej *~ .swp .swo to backup-file block · back to Abrams · links: add noreferrer to all target=_blank rel attributes 56770cca →