fix: bak-guard regex misses .bak- filenames; rm leaked public/index.html.bak snapshot

a8da0ee2d65afac65ea9c3fb8142f05b0a2373d9 · 2026-05-30 21:32:34 -0700 · SteveStudio2

The defense-in-depth middleware regex `\.(bak)(\.|$)` only blocked `.bak.`
or `.bak` at end-of-string, so timestamped snapshots like
`index.html.bak-20260526152130` were served with HTTP 200. Fixed regex to
also match `.bak-` delimiter. Removed the leaked backup file from public/.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M server.js

Diff

commit a8da0ee2d65afac65ea9c3fb8142f05b0a2373d9
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sat May 30 21:32:34 2026 -0700

    fix: bak-guard regex misses *.bak-* filenames; rm leaked public/index.html.bak snapshot
    
    The defense-in-depth middleware regex `\.(bak)(\.|$)` only blocked `.bak.`
    or `.bak` at end-of-string, so timestamped snapshots like
    `index.html.bak-20260526152130` were served with HTTP 200. Fixed regex to
    also match `.bak-` delimiter. Removed the leaked backup file from public/.
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 48bb8bd..7477348 100644
--- a/server.js
+++ b/server.js
@@ -163,7 +163,7 @@ require("./_universal-auth")(app, cfg.auth);
 // Defense-in-depth: never serve snapshot files (*.bak, *.bak.*, *.pre-*) from
 // the static root even if one slips into public/ untracked.
 app.use((req, res, next) => {
-  if (/\.(bak)(\.|$)|\.pre-/.test(req.path)) return res.status(404).end();
+  if (/\.bak(\.|[-]|$)|\.pre-/.test(req.path)) return res.status(404).end();
   next();
 });
 // Clean-URL routes for extension-less nav links used across interior pages.

← 8bf54d2 feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Architecturalwallcoverings · fix: /api/facets counts the active filtered set (drill-down) 6ad1935 →