server: 404-guard editor/snapshot paths before express.static

981b77e74d4bdeb9b259f6fb9cbd2c9f1f2fcc0c · 2026-05-19 17:28:46 -0700 · Steve Abrams

Adds a tiny middleware just upstream of express.static('web-interface')
that hard-404s any request whose path matches *.bak / *.bak.* /
*.pre-* / *.swp / *.swo / trailing-tilde. Even if a future snapshot
file slips into the served directory, it cannot leak. Matches the
fleet-wide rule from the refactor sweep.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 981b77e74d4bdeb9b259f6fb9cbd2c9f1f2fcc0c
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 17:28:46 2026 -0700

    server: 404-guard editor/snapshot paths before express.static
    
    Adds a tiny middleware just upstream of express.static('web-interface')
    that hard-404s any request whose path matches *.bak / *.bak.* /
    *.pre-* / *.swp / *.swo / trailing-tilde. Even if a future snapshot
    file slips into the served directory, it cannot leak. Matches the
    fleet-wide rule from the refactor sweep.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/server.js b/server.js
index 3508c14..65e629d 100644
--- a/server.js
+++ b/server.js
@@ -494,6 +494,15 @@ async function searchWeb(query) {
   }
 }
 
+// 404-guard — never serve editor/snapshot files even if one slips into web-interface/
+// (*.bak, *.bak.<anything>, anything containing .pre-, swap files)
+app.use((req, res, next) => {
+  if (/\.(bak|bak\..*|swp|swo)(\?|$)/i.test(req.path) || /\.pre-/i.test(req.path) || /~$/.test(req.path)) {
+    return res.status(404).type('text/plain').send('Not Found');
+  }
+  next();
+});
+
 // Serve static files from web-interface directory
 app.use(express.static(path.join(__dirname, 'web-interface')));

← 6c73f87 gitignore: exclude .bak/.pre-/swap snapshot files · back to B Version 1 · Update Claude model IDs to claude-opus-4-8 (Opus 4.8 upgrade 295343e →