add 404-guard middleware for .bak / .pre- snapshot paths

77e2f8b8ef0a9684888b5a3d08ff28ab01a63d97 · 2026-05-19 17:33:23 -0700 · Steve Abrams

Defense-in-depth — even though no static root is served today, this
prevents accidental exposure of editor backup files if a static dir
gets added later.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 77e2f8b8ef0a9684888b5a3d08ff28ab01a63d97
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 17:33:23 2026 -0700

    add 404-guard middleware for .bak / .pre- snapshot paths
    
    Defense-in-depth — even though no static root is served today, this
    prevents accidental exposure of editor backup files if a static dir
    gets added later.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/server.js b/server.js
index 7fd6cb7..54d7087 100644
--- a/server.js
+++ b/server.js
@@ -56,6 +56,14 @@ const app = express();
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json());
 
+// 404-guard: never serve snapshot/backup files even if accidentally dropped in tree
+app.use((req, res, next) => {
+  if (/\.(bak|bak\.[^/]+)$|(^|\/)\.pre-|\/\.pre-/.test(req.path)) {
+    return res.status(404).send('Not found');
+  }
+  next();
+});
+
 // Basic Auth
 app.use((req, res, next) => {
   const h = req.headers.authorization || '';

← c72578f broaden .gitignore to cover .bak.* and .pre-* snapshot files · back to Mfr Review Viewer · SECURITY HOLD — live Shopify shpat_ token committed at serve 942d742 →