Guard .bak/.pre-/.orig paths in static middleware and gitignore

2cee76165f3c7f2ac38f54a0505a42c28b6142c0 · 2026-05-19 15:14:00 -0700 · SteveStudio2

A 404-guard middleware now sits before express.static so any future
accidentally-committed snapshot file (server.js.bak, public/index.html.pre-fix,
etc.) cannot leak via a direct URL hit. .gitignore broadened to match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 2cee76165f3c7f2ac38f54a0505a42c28b6142c0
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 15:14:00 2026 -0700

    Guard .bak/.pre-/.orig paths in static middleware and gitignore
    
    A 404-guard middleware now sits before express.static so any future
    accidentally-committed snapshot file (server.js.bak, public/index.html.pre-fix,
    etc.) cannot leak via a direct URL hit. .gitignore broadened to match.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore |  9 +++++++++
 server.js  | 13 +++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/.gitignore b/.gitignore
index 5f5d1a1..97b9a96 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,12 @@ data/raw/
 dist/
 build/
 .next/
+
+# Snapshot / backup files — never commit these
+*.bak
+*.bak.*
+*.pre-*
+.pre-*
+*.orig
+*.swp
+*~
diff --git a/server.js b/server.js
index b164967..b415984 100644
--- a/server.js
+++ b/server.js
@@ -92,6 +92,19 @@ async function ensureSchema() {
   }
 }
 
+// 404-guard snapshot/backup paths BEFORE static so an accidentally-committed
+// `*.bak` / `*.bak.<n>` / `*.pre-<label>` file under public/ can never leak.
+// Also covers query-string variants (`?backup`) and tilde-suffix backups.
+app.use((req, res, next) => {
+  const p = req.path;
+  if (/\.(bak|bak\.[^/]+|pre-[^/]+|orig|swp)$/i.test(p) ||
+      /(^|\/)\.pre-[^/]+/.test(p) ||
+      /~$/.test(p)) {
+    return res.status(404).type('text/plain').send('not-found');
+  }
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public'), { maxAge: '1h' }));
 
 // /api — JSON index of all public API endpoints. Useful for integrators

← d70a112 Makefile: audit target (fleet-status + fleet-smoke) · back to AsSeenInMovies · Add rel=noreferrer to every target=_blank link 694e783 →