add: 404-guard middleware blocks .bak/.pre-* requests (defense-in-depth)

7b8c1f0c66edd0e04e66abf89e7ba64ccbe3997e · 2026-05-25 21:07:26 -0700 · Steve

Files touched

M server.js

Diff

commit 7b8c1f0c66edd0e04e66abf89e7ba64ccbe3997e
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:07:26 2026 -0700

    add: 404-guard middleware blocks .bak/.pre-* requests (defense-in-depth)
---
 server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server.js b/server.js
index 5aa6613..4350a20 100644
--- a/server.js
+++ b/server.js
@@ -135,6 +135,14 @@ function sortProducts(list, mode) {
 }
 
 
+// 404-guard: never serve backup/pre-edit snapshots even if one slips into a
+// served directory. Returns plain 404 so the bak file's contents never leak.
+app.use((req, res, next) => {
+  if (/\.(bak|pre-[\w.-]+)(\.[\w-]+)?$|\.bak\.\d+$|\.pre-/.test(req.path)) {
+    return res.status(404).type('text/plain').send('Not found');
+  }
+  next();
+});
 // DW fleet middleware: strip `vendor` field + `vendors` facet from all /api/* JSON
 // responses + drop ?vendor= query before downstream handlers. Defense-in-depth so
 // the customer-facing API surface never leaks vendor names even if a route forgets.

← 45090d9 add: clean-URL routes /history /care /sourcing /trade /vocab · back to Greenwallcoverings · harden: noopener noreferrer on target=_blank (Facebook link eb10007 →