guard against serving .bak/.pre- snapshot files; widen .gitignore to match

58bcf6a4eed5eccee5768da4aad38d4f2d81fb6d · 2026-05-19 15:14:41 -0700 · Steve Abrams

Adds a tiny middleware ahead of express.static that returns the 404 page for
any URL path containing *.bak, *.bak.*, or .pre-* segments — so a backup file
accidentally dropped into public/ can never leak to the open web. Widens
.gitignore to keep those snapshot files out of the repo in the first place.
No bak/pre files are currently tracked; this is preventative.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 58bcf6a4eed5eccee5768da4aad38d4f2d81fb6d
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 15:14:41 2026 -0700

    guard against serving .bak/.pre- snapshot files; widen .gitignore to match
    
    Adds a tiny middleware ahead of express.static that returns the 404 page for
    any URL path containing *.bak, *.bak.*, or .pre-* segments — so a backup file
    accidentally dropped into public/ can never leak to the open web. Widens
    .gitignore to keep those snapshot files out of the repo in the first place.
    No bak/pre files are currently tracked; this is preventative.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore | 6 ++++++
 server.js  | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/.gitignore b/.gitignore
index 1924158..ca4e582 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,9 @@ tmp/
 dist/
 build/
 .next/
+
+# Snapshot / backup files — never commit or serve these
+*.bak
+*.bak.*
+*.pre-*
+.pre-*
diff --git a/server.js b/server.js
index ce39fb7..3d1aa93 100644
--- a/server.js
+++ b/server.js
@@ -43,6 +43,15 @@ app.use((_req, res, next) => {
   next();
 });
 
+// 404-guard — backup/snapshot files (*.bak, *.bak.*, *.pre-*) must never serve
+// from the static root, even if one slips into public/ by accident.
+app.use((req, res, next) => {
+  if (/\.bak(\.|$)|\.pre-|(^|\/)\.pre-/i.test(req.path)) {
+    return res.status(404).send(page404());
+  }
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public'), { maxAge: '1d' }));
 
 // Health check

← 58420cb add noreferrer to every target=_blank external link · back to Customdigitalmurals · make server.js self-contained — gate _shared/admin-catalog b 24e237e →