feat(server): 404-guard for snapshot/editor file paths

13b832f728a1889f36862f0eda2c6e24cf226fab · 2026-05-19 21:09:33 -0700 · SteveStudio2

Adds an Express middleware ahead of express.static that returns 404 for
any request matching *.bak / *.bak.* / *.pre-* / *.orig / *.rej / *.swp
/ *~ — defense in depth so stray snapshot files never leak from public/
even if the gitignore is bypassed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 13b832f728a1889f36862f0eda2c6e24cf226fab
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 21:09:33 2026 -0700

    feat(server): 404-guard for snapshot/editor file paths
    
    Adds an Express middleware ahead of express.static that returns 404 for
    any request matching *.bak / *.bak.* / *.pre-* / *.orig / *.rej / *.swp
    / *~ — defense in depth so stray snapshot files never leak from public/
    even if the gitignore is bypassed.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/server.js b/server.js
index 72cc51d..f837278 100644
--- a/server.js
+++ b/server.js
@@ -13,6 +13,17 @@ const OLLAMA = process.env.OLLAMA || 'http://localhost:11434';
 
 const app = express();
 app.use(express.json({ limit: '8kb' }));
+
+// 404-guard for snapshot/editor detritus — even if a *.bak / *.pre-* / *.orig
+// / *.rej / *.swp / *~ file accidentally lands in public/, never serve it.
+// Standing rule from CLAUDE.md fleet-refactor sweep.
+app.use((req, res, next) => {
+  if (/\.(bak|orig|rej|swp)(\.|$)|\.pre-|~$/i.test(req.path)) {
+    return res.status(404).type('text/plain').send('not found');
+  }
+  next();
+});
+
 // no caching of HTML — dashboard iterates fast, stale HTML hides new sections
 app.use(express.static(path.join(__dirname, 'public'), {
   maxAge: 0,

← ccf3789 chore: broaden .gitignore to cover *.bak / *.pre-* / *.orig · back to Macstudio2 Dashboard · gitignore: add missing standard excludes (tmp/ dist/ build/ ad4753b →