code-health: 404-guard server.js/package*.json + .orig/.save/.old/.backup.json in static server

c57fedaf3f0a19816155571fb3c54ca2b3b26a50 · 2026-06-12 09:20:52 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit c57fedaf3f0a19816155571fb3c54ca2b3b26a50
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Jun 12 09:20:52 2026 -0700

    code-health: 404-guard server.js/package*.json + .orig/.save/.old/.backup.json in static server
---
 server.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/server.js b/server.js
index bda8895..9755d62 100644
--- a/server.js
+++ b/server.js
@@ -141,9 +141,13 @@ app.post('/api/send-inquiry', (req, res) => {
 // Health endpoint
 app.get('/health', (req, res) => res.json({ ok: true, service: 'goldleafwallpaper', port: PORT }));
 
-// Never serve editor/snapshot files — .bak / .bak.* / .pre-* leak the full source history
+// Never serve editor/snapshot files (.bak/.pre-*/.orig/.save/.old/.backup.json leak source
+// history) or server source/manifest files (server.js, package*.json, *.conf, *.sh expose
+// internals + dependency versions). express.static(__dirname) would otherwise serve them.
 app.use((req, res, next) => {
-  if (/(\.bak(\.|$)|\.pre-)/i.test(req.path)) {
+  const base = path.basename(req.path);
+  if (/(\.bak(\.|$)|\.pre-|\.orig$|\.save$|\.old$|\.backup\.json$|\.conf$|\.sh$)/i.test(req.path) ||
+      /^(server\.js|package\.json|package-lock\.json)$/i.test(base)) {
     return res.status(404).send('Not found');
   }
   next();

← 2bba3dd Scrub residual vendor names from products.json (title/vendor · back to Goldleafwallpaper · secret-strip goldleafwallpaper: env-first the hardcoded Geor f68dbe4 →