add 404-guard middleware for snapshot/backup-file paths

902fdfe4c2a55d7c0cdf09869aeffb7c81f417dd · 2026-05-19 17:24:31 -0700 · SteveStudio2

Defense-in-depth: any HTTP request matching .bak / .pre- / .orig
/ .swp returns 404 before any (future) static middleware can serve
it. Today the app has no static mount, but this codifies the rule
so accidental future additions cannot leak repo snapshot files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 902fdfe4c2a55d7c0cdf09869aeffb7c81f417dd
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 17:24:31 2026 -0700

    add 404-guard middleware for snapshot/backup-file paths
    
    Defense-in-depth: any HTTP request matching .bak / .pre- / .orig
    / .swp returns 404 before any (future) static middleware can serve
    it. Today the app has no static mount, but this codifies the rule
    so accidental future additions cannot leak repo snapshot files.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server.js b/server.js
index 98aff11..1ad9d6a 100644
--- a/server.js
+++ b/server.js
@@ -212,6 +212,16 @@ const app = express();
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '5mb' }));
 
+// Defense-in-depth: 404 any request that hits a snapshot/backup-file extension.
+// Runs BEFORE any static middleware that might be added later, so leftover
+// *.bak / *.pre-* files in the project root never leak via HTTP.
+app.use((req, res, next) => {
+  if (/\.(bak|orig|swp)(\.|$)|\.pre-/i.test(req.path)) {
+    return res.status(404).send('not found');
+  }
+  next();
+});
+
 // LAN/tailnet auth gate (env-only, no source fallback)
 const BASIC_AUTH = process.env.BASIC_AUTH;
 if (!BASIC_AUTH) {

← ce004ac broaden .gitignore to cover snapshot/backup file patterns · back to Archive Agent · security: strip hardcoded dw_admin DSN password -> env-first 6f849da →