fix: remove leaked public bak file and harden 404 guard regex

57a5c2201be42b1bd57843c3707c58d03213425a · 2026-05-30 21:30:14 -0700 · Steve Abrams

- Deleted public/index.html.bak-20260526152130 which was served with 200
  (the .bak-<timestamp> suffix escaped the old regex guard)
- Updated 404 guard in server.js: \.bak([.\-].*)? now matches *.bak-* dated
  variants in addition to *.bak and *.bak.N
- Added *.bak-* glob to .gitignore so timestamped bak files stay untracked

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 57a5c2201be42b1bd57843c3707c58d03213425a
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:30:14 2026 -0700

    fix: remove leaked public bak file and harden 404 guard regex
    
    - Deleted public/index.html.bak-20260526152130 which was served with 200
      (the .bak-<timestamp> suffix escaped the old regex guard)
    - Updated 404 guard in server.js: \.bak([.\-].*)? now matches *.bak-* dated
      variants in addition to *.bak and *.bak.N
    - Added *.bak-* glob to .gitignore so timestamped bak files stay untracked
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 1140724..3a7a026 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,4 +11,5 @@ build/
 .next/
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
diff --git a/server.js b/server.js
index 18b671a..266aa8d 100644
--- a/server.js
+++ b/server.js
@@ -152,7 +152,7 @@ app.use(express.json({ limit: '256kb' }));
 // Defense-in-depth 404 guard: snapshot files (*.bak, *.bak.*, *.pre-*, *.orig)
 // must never leak via the static-file middleware. Mount BEFORE express.static.
 app.use((req, res, next) => {
-  if (/\.(bak|orig)(\.\d+)?$|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.(bak|orig)([.\-].*)?$|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js

← b9ce903 feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Healthcarewallpaper · scrub residual 3rd-party vendor names from products.json sou 4c64d72 →