server: 404-guard for .bak / .pre-* snapshot paths before static mount

07bd1a8835a786476a40905db630d0645becb2cb · 2026-05-19 17:27:42 -0700 · SteveStudio2

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 07bd1a8835a786476a40905db630d0645becb2cb
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 17:27:42 2026 -0700

    server: 404-guard for *.bak / *.pre-* snapshot paths before static mount
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server.js b/server.js
index cfa0fc5..fea405a 100644
--- a/server.js
+++ b/server.js
@@ -256,6 +256,16 @@ app.use((req, res, next) => {
   };
   next();
 });
+// Snapshot-path guard — runs before express.static so editor backup files
+// (.bak, .bak.<n>, .pre-<tag>, .orig, .rej, ~) can never be served from any
+// public mount, even if one accidentally lands in public/. Returns 404 with
+// no body so probes don't even learn the path shape.
+app.use((req, res, next) => {
+  if (/(\.bak(\.|$)|\.pre-|\.orig$|\.rej$|~$)/i.test(req.path)) {
+    return res.status(404).end();
+  }
+  next();
+});
 app.use('/css', express.static(path.join(__dirname, 'public/css'), { maxAge: '1h' }));
 
 // favicon.svg — same brand mark as the data: URI in <head>, but served as

← 50c56b7 gitignore: exclude *.bak / *.pre-* / *.orig snapshot files · back to build-pages · smoke: 6 snapshot-path 404-guard checks (.bak / .bak.N / .pr c5fae60 →