remove 3 stale .bak/.pre-* snapshot files + add snapshot 404-guard in server.js

aa5e4d3d4b38fa4e36b078fd449e7aac3b10f901 · 2026-05-25 21:08:09 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit aa5e4d3d4b38fa4e36b078fd449e7aac3b10f901
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:08:09 2026 -0700

    remove 3 stale .bak/.pre-* snapshot files + add snapshot 404-guard in server.js
---
 server.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server.js b/server.js
index 3dec30a..816e463 100644
--- a/server.js
+++ b/server.js
@@ -140,6 +140,12 @@ function sortProducts(list, mode) {
 
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '256kb' }));
+// Defense-in-depth 404 guard: snapshot files (*.bak, *.bak.*, *.pre-*, *.orig)
+// must never leak via the static-file middleware. Mount BEFORE express.static.
+app.use((req, res, next) => {
+  if (/\.(bak|orig)(\.\d+)?$|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  next();
+});
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js
 require('./_universal-contact')(app, { siteName: "Healthcare Wallpaper", zdColor: "#80c8b8", zdPosition: 'right' });
 require('./_universal-auth')(app, { siteName: "healthcarewallpaper" });

← 5658048 retag aesthetic from PG: 600 rows updated · back to Healthcarewallpaper · scrub p.vendor render from Ideas rail + add noreferrer to fb 8c74f6a →