404-guard: block .bak / .pre-* requests at HTTP surface (defense-in-depth)

998d7480dd2ab3d51b51ce7f8967bd0b7d36e5cb · 2026-05-25 21:15:49 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 998d7480dd2ab3d51b51ce7f8967bd0b7d36e5cb
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:15:49 2026 -0700

    404-guard: block .bak / .pre-* requests at HTTP surface (defense-in-depth)
---
 server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server.js b/server.js
index 4d74c35..c3bfb00 100644
--- a/server.js
+++ b/server.js
@@ -146,6 +146,14 @@ app.use(require('../_shared/api-vendor-redact'));
 
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '256kb' }));
+
+// 404-guard: never serve .bak / .pre-* backup files even if one slips into
+// public/ — gitignore already filters them, this is defense-in-depth at the
+// HTTP surface (paired with the standing rule "no source backups in webroot").
+app.use((req, res, next) => {
+  if (/\.bak(\.|$)|\.pre-/.test(req.path)) return res.status(404).send('Not found');
+  next();
+});
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js
 require('./_universal-contact')(app, { siteName: "Hotel Wallcoverings", zdColor: "#d4a847", zdPosition: 'right' });
 require('./_universal-auth')(app, { siteName: "hotelwallcoverings" });

← 302cec3 wire api-vendor-redact middleware as first app.use (fleet-wi · back to Hotelwallcoverings · /api/facets: count from filtered list (q/aesthetic/vendor), d292928 →