Add 404-guard middleware for .bak/.pre- snapshot paths

af5571187bd417242b84330abb1ab580b553915b · 2026-05-19 21:41:43 -0700 · Steve Abrams

Prevents stray backup/snapshot files from ever being served by
express.static('public') even if accidentally dropped in.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit af5571187bd417242b84330abb1ab580b553915b
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 21:41:43 2026 -0700

    Add 404-guard middleware for .bak/.pre- snapshot paths
    
    Prevents stray backup/snapshot files from ever being served by
    express.static('public') even if accidentally dropped in.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/server.js b/server.js
index 41e2b92..bed039a 100644
--- a/server.js
+++ b/server.js
@@ -13,6 +13,15 @@ const PORT = 3041;
 // Middleware
 app.use(cors());
 app.use(express.json());
+
+// 404-guard: never serve snapshot/backup files even if accidentally dropped into static root
+app.use((req, res, next) => {
+  if (/\.(bak)(\.|$)|\.pre-/i.test(req.path)) {
+    return res.status(404).send('Not found');
+  }
+  next();
+});
+
 app.use(express.static('public'));
 
 // Create HTTP server and WebSocket server

← 72cc08c untrack node_modules per standing rule (was tracking 854 fil · back to YOLO Progress Viewer · Add noopener,noreferrer to external window.open dashboard li b3aa255 →