add 404-guard for .bak/.pre-* files — defense-in-depth against accidental serve

e13d76153c43fbdd1ba183520e0373307ae79d42 · 2026-05-25 21:15:08 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit e13d76153c43fbdd1ba183520e0373307ae79d42
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:15:08 2026 -0700

    add 404-guard for .bak/.pre-* files — defense-in-depth against accidental serve
---
 server.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server.js b/server.js
index 74117f2..0161592 100644
--- a/server.js
+++ b/server.js
@@ -138,6 +138,12 @@ function sortProducts(list, mode) {
 
 
 app.use(require('../_shared/api-vendor-redact'));
+// 404-guard for backup/pre-fix snapshot files — never serve them even if they
+// slip into a deploy dir (defense-in-depth alongside .gitignore + rsync excludes).
+app.use((req, res, next) => {
+  if (/\.(bak|pre-[^/]+)(\.|$)/i.test(req.path)) return res.status(404).send('Not found');
+  next();
+});
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '256kb' }));
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js

← bda38a4 fix /api/facets total — reflect filtered (niche) list count, · back to Linenwallpaper · add clean-URL routes for nav links — /history /vocabulary /s ded12ab →