add 404 guard middleware for .bak / .pre- snapshot paths

e0d53c13034f27013b1866506c2ae36c189664f4 · 2026-05-19 17:33:25 -0700 · Steve

Defense-in-depth: even though no snapshot files are tracked or on disk
today, this prevents future accidental commits from leaking through the
express.static('public') mount.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit e0d53c13034f27013b1866506c2ae36c189664f4
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 19 17:33:25 2026 -0700

    add 404 guard middleware for .bak / .pre- snapshot paths
    
    Defense-in-depth: even though no snapshot files are tracked or on disk
    today, this prevents future accidental commits from leaking through the
    express.static('public') mount.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/server.js b/server.js
index dd58b6f..08a2893 100644
--- a/server.js
+++ b/server.js
@@ -51,6 +51,15 @@ const agentState = {
 app.use(cors());
 app.use(express.json({ limit: '50mb' })); // Increase limit for base64 images
 app.use(express.urlencoded({ limit: '50mb', extended: true }));
+
+// Guard: never serve snapshot/backup files from static root (defense-in-depth)
+app.use((req, res, next) => {
+  if (/\.(bak|bak\..*|pre-.*)$|\.pre-/i.test(req.path)) {
+    return res.status(404).send('Not Found');
+  }
+  next();
+});
+
 app.use(express.static('public'));
 
 // Configure multer for file uploads

← 6cc57ee snapshot: 1 file(s) changed, ~1 modified · back to Melanie Project · broaden .gitignore to cover *.bak.* and *.pre-* snapshots 9234dcf →