fix: 404-guard so .bak/.pre- snapshot paths never serve from static root

78e1c9dfa7824c0e43f261c0271ff878da3a7985 · 2026-05-19 08:00:26 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 78e1c9dfa7824c0e43f261c0271ff878da3a7985
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 08:00:26 2026 -0700

    fix: 404-guard so .bak/.pre- snapshot paths never serve from static root
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 3a40d99..9fd1991 100644
--- a/server.js
+++ b/server.js
@@ -117,9 +117,18 @@ function loadData() {
 loadData();
 
 const app = express();
-app.use(express.static(path.join(__dirname, 'public')));
 app.set('trust proxy', 1);
 
+// ── Static guard: never serve snapshot files (*.bak / *.pre-*) ────────────────
+app.use((req, res, next) => {
+  if (/\.(bak|bak\.[^/]*)$/i.test(req.path) || /\.pre-[^/]*$/i.test(req.path)) {
+    return res.status(404).send('<h1>Not found</h1>');
+  }
+  next();
+});
+
+app.use(express.static(path.join(__dirname, 'public')));
+
 // ── HTML helpers ─────────────────────────────────────────────────────────────
 const HTML_HEAD = (title, desc) => `<!DOCTYPE html>
 <html lang="en">

← d43943c chore: untrack server.js.pre-sort-skill snapshot, broaden .g · back to Carmelwallpapers · fix: add noreferrer to external target=_blank links 20aecc2 →