guard against serving .bak / .pre- snapshot files

31e910d6a1d34b699280f1547adf66ea0fa28a69 · 2026-05-19 17:36:15 -0700 · Steve

Broaden .gitignore to cover *.bak, *.bak.*, *.pre-*, *.orig, *~ editor
leftovers so they never get committed, AND add an Express middleware
that returns 404 for any request whose path matches those patterns
even if a snapshot file somehow lands in public/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 31e910d6a1d34b699280f1547adf66ea0fa28a69
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 19 17:36:15 2026 -0700

    guard against serving .bak / .pre- snapshot files
    
    Broaden .gitignore to cover *.bak, *.bak.*, *.pre-*, *.orig, *~ editor
    leftovers so they never get committed, AND add an Express middleware
    that returns 404 for any request whose path matches those patterns
    even if a snapshot file somehow lands in public/.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore | 6 ++++++
 server.js  | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/.gitignore b/.gitignore
index fa8614d..2edcc4a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,9 @@ build/
 .next/
 data/raw/
 data/cache/
+# editor / refactor snapshot junk — never commit, never serve
+*.bak
+*.bak.*
+*.pre-*
+*.orig
+*~
diff --git a/server.js b/server.js
index c0a29c8..c0f2409 100644
--- a/server.js
+++ b/server.js
@@ -626,6 +626,15 @@ app.get('/pr/:slug', async (req, res) => {
   res.sendFile(path.join(__dirname, 'public', 'province.html'));
 });
 
+// Snapshot-file 404 guard — refuse to ever serve .bak / .bak.* / .pre-* /
+// .orig editor leftovers, even if one slips into public/ by accident.
+app.use((req, res, next) => {
+  if (/\.(bak|orig)(\.|$)|\.pre-/i.test(req.path)) {
+    return res.status(404).type('text/plain').send('not found');
+  }
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public')));
 
 app.listen(PORT, '0.0.0.0', () => {

← 0223d43 upgrade target=_blank links to rel="noopener noreferrer" · back to Costa Rica · Localize all region/place images (Wikimedia burst-429 fix) + 4ad9f20 →