guard static root from serving .bak / .pre-* / .orig snapshot files

d7d7eb8c9b969886c934303b3b5bcaae82b0492e · 2026-05-19 18:33:53 -0700 · Steve Abrams

Adds an Express middleware before static() that returns 404 for any path
matching .bak, .bak.<ts>, .pre-*, or .orig. Defense-in-depth — .gitignore
already prevents them from being committed, but this catches any local
snapshot dropped into public/ before deploy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit d7d7eb8c9b969886c934303b3b5bcaae82b0492e
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 18:33:53 2026 -0700

    guard static root from serving .bak / .pre-* / .orig snapshot files
    
    Adds an Express middleware before static() that returns 404 for any path
    matching .bak, .bak.<ts>, .pre-*, or .orig. Defense-in-depth — .gitignore
    already prevents them from being committed, but this catches any local
    snapshot dropped into public/ before deploy.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server.js b/server.js
index 345c8b3..3319c7b 100644
--- a/server.js
+++ b/server.js
@@ -16,6 +16,14 @@ const pool = process.env.DATABASE_URL
   : new Pool({ host: '/tmp', database: 'dw_unified', user: process.env.USER || 'stevestudio2' });
 
 app.use(express.json());
+
+// Static-root 404 guard — never serve snapshot/backup artifacts from public/
+// even if one accidentally lands on disk (.bak / .bak.<ts> / .pre-* / .orig).
+app.use((req, res, next) => {
+  if (/\.(bak|orig)(\.|$)|\.pre-/i.test(req.path)) return res.status(404).end();
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public')));
 
 // ---- shared health + identity ---------------------------------------------

← 994fe12 snapshot before refactor pass · back to Designer Line · add price ↑/↓ + title z→a + sku z→a sort options to commerce f7ab358 →