add 404-guard middleware before express.static to refuse serving snapshot/.bak files

7115e4d1ba59a5c52ebb49ce53ba69861976caf1 · 2026-05-19 21:25:10 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 7115e4d1ba59a5c52ebb49ce53ba69861976caf1
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 21:25:10 2026 -0700

    add 404-guard middleware before express.static to refuse serving snapshot/.bak files
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server.js b/server.js
index 080706c..e35139b 100644
--- a/server.js
+++ b/server.js
@@ -47,6 +47,14 @@ function basicAuth(req, res, next) {
 }
 
 app.use(basicAuth);
+
+// 404-guard: refuse to serve snapshot/backup files even if they leak into public/
+const SNAPSHOT_RE = /\.(bak|orig|rej|swp)$|\.(bak|pre-)[^/]*$|~$/i;
+app.use((req, res, next) => {
+  if (SNAPSHOT_RE.test(req.path)) return res.status(404).end();
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public'), { etag: false, maxAge: 0, setHeaders: (res) => { res.set('Cache-Control', 'no-store'); } }));
 app.use('/generated', express.static(path.join(__dirname, 'generated')));

← ea54425 untrack sqlite wal/shm transient files + broaden gitignore f · back to SmokeShop · add noreferrer to external Google Sheets link (noopener+nore ce200aa →