server: 404-guard for .bak/.pre- snapshot paths before static mount

2b841f7f0453fa5f68dc5f8afcb8a9d52210ae4f · 2026-05-19 17:24:14 -0700 · SteveStudio2

Stops snapshot/backup artifacts from ever serving out of the static root if
one is accidentally dropped into public/. Returns 404 plain-text before
express.static handles the request.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 2b841f7f0453fa5f68dc5f8afcb8a9d52210ae4f
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 17:24:14 2026 -0700

    server: 404-guard for .bak/.pre- snapshot paths before static mount
    
    Stops snapshot/backup artifacts from ever serving out of the static root if
    one is accidentally dropped into public/. Returns 404 plain-text before
    express.static handles the request.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server.js b/server.js
index 1111236..a396991 100644
--- a/server.js
+++ b/server.js
@@ -26,6 +26,13 @@ app.get('/healthz', (_req, res) => {
   });
 });
 
+// 404-guard: never serve snapshot/backup files from the static root
+const SNAPSHOT_PATH_RE = /(?:\.bak(?:\.|$)|\.pre-|\/\.pre-)/i;
+app.use((req, res, next) => {
+  if (SNAPSHOT_PATH_RE.test(req.path)) return res.status(404).type('text/plain').send('not found');
+  next();
+});
+
 // Public landing
 app.use('/', express.static(path.join(__dirname, 'public'), { extensions: ['html'] }));

← 25ee12d gitignore: exclude .bak/.pre-* snapshot artifacts · back to Crankd · Add per-site favicon (kills /favicon.ico 404) 466e250 →