fix: backup-guard regex now blocks .bak-TIMESTAMP filenames

0b696e8f44a0431f7afd23f0b5d16595649bc5a3 · 2026-05-30 21:29:07 -0700 · Steve Abrams

Pattern \.bak\. only matched dot-bak-dot; files like index.html.bak-20260526152130
were served by express.static. Updated regex to also match .bak- so all
timestamped backup variants return 404.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 0b696e8f44a0431f7afd23f0b5d16595649bc5a3
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:29:07 2026 -0700

    fix: backup-guard regex now blocks .bak-TIMESTAMP filenames
    
    Pattern \.bak\. only matched dot-bak-dot; files like index.html.bak-20260526152130
    were served by express.static. Updated regex to also match .bak- so all
    timestamped backup variants return 404.
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index ea35370..290d2e5 100644
--- a/server.js
+++ b/server.js
@@ -162,7 +162,7 @@ require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
 // Guard: never serve snapshot/backup files from static root.
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[^/]*|orig|swp)$|\.bak\.|\.pre-/i.test(req.path)) {
+  if (/\.(bak|orig|swp)([\.\-]|$)|\.bak[\.\-]|\.pre-/i.test(req.path)) {
     return res.status(404).send('Not found');
   }
   next();

← d918b1a feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Museumwallpaper · fix: remove public/index.html.bak-20260526152130 source leak 7dcaf0b →