server: 404-guard for bak/swp/orig/rej/pre-* URLs before static

971e9e263d9c1369bc431f46d93d4bd188931e71 · 2026-05-19 18:44:34 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 971e9e263d9c1369bc431f46d93d4bd188931e71
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 18:44:34 2026 -0700

    server: 404-guard for bak/swp/orig/rej/pre-* URLs before static
---
 server.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server.js b/server.js
index 3e9c13c..ba1934e 100644
--- a/server.js
+++ b/server.js
@@ -14,6 +14,16 @@ const app = express();
 const PORT = parseInt(process.env.PORT || '9913', 10);
 const MIN_PRODUCTS = parseInt(process.env.MIN_PRODUCTS || '10', 10);
 
+// ─── 404-guard: never serve editor leftovers / swap / backup files ────────
+// Hard-block URLs that match common editor/backup junk patterns BEFORE the
+// static handler can ever try to read them off disk. Pattern-matched on the
+// URL path so it works even if a tracked file slips past .gitignore.
+const JUNK_FILE_RE = /\.(bak|orig|rej|swp|swo)(?:\.[^/]*)?$|\.pre-[^/]*$|~$/i;
+app.use((req, res, next) => {
+  if (JUNK_FILE_RE.test(req.path)) return res.status(404).end();
+  next();
+});
+
 // Allow widgets to be iframed from any origin; serve them via a static handler
 // that also sets explicit frame-friendly headers BEFORE the general static mount.
 const widgetStatic = express.static(path.join(__dirname, 'public/widget'), {

← fdc5121 gitignore: broaden bak/swp/orig/rej exclusions · back to Fleet Tv · public: add noreferrer to every target=_blank link cb2e344 →