server: 404-guard snapshot/backup file paths

0274af0edc3a708719042e4f0c1736f7ff25b009 · 2026-05-19 17:27:48 -0700 · SteveStudio2

Defensive middleware blocks .bak, .bak.*, .pre-*, .orig, .rej paths
with a plain 404. No express.static() mount exists today, but the
guard ensures that if one is added later (or a reverse proxy fronts
the working tree) those files can never leak.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 0274af0edc3a708719042e4f0c1736f7ff25b009
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 17:27:48 2026 -0700

    server: 404-guard snapshot/backup file paths
    
    Defensive middleware blocks .bak, .bak.*, .pre-*, .orig, .rej paths
    with a plain 404. No express.static() mount exists today, but the
    guard ensures that if one is added later (or a reverse proxy fronts
    the working tree) those files can never leak.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/server.js b/server.js
index 8cc1e7e..be2a021 100644
--- a/server.js
+++ b/server.js
@@ -290,6 +290,15 @@ async function setupWatcher(entry) {
 const app = express();
 app.disable('x-powered-by');
 
+// Defensive 404 guard — never serve snapshot/backup file paths even if a
+// future express.static() mount or reverse proxy exposes the working tree.
+app.use((req, res, next) => {
+  if (/\.(bak|orig|rej)(\b|\.)|\.pre-/i.test(req.path)) {
+    return res.status(404).send('not found');
+  }
+  next();
+});
+
 app.get('/healthz', (_req, res) => {
   res.json({
     ok: true,

← b22f241 gitignore: cover snapshot/backup file patterns · back to Auto Deploy Watcher · chore: macstudio3 migration — reconcile from mac2 + repoint 040d8b3 →