fix: remove public .bak- snapshot leak, harden bak-guard regex and gitignore

4b657cfd76917c7cc8e2d566ba892df9241034f6 · 2026-05-30 21:28:54 -0700 · Steve Abrams

- Deleted public/index.html.bak-20260526152130 (was served 200 via express.static)
- Fixed middleware regex /.bak[\.\-]|\.bak$/ to also block .bak-* filenames (was only blocking .bak. or .bak$)
- Added *.bak-* pattern to .gitignore (*.bak.* pattern did not match hyphen-separated timestamps)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 4b657cfd76917c7cc8e2d566ba892df9241034f6
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:28:54 2026 -0700

    fix: remove public .bak- snapshot leak, harden bak-guard regex and gitignore
    
    - Deleted public/index.html.bak-20260526152130 (was served 200 via express.static)
    - Fixed middleware regex /.bak[\.\-]|\.bak$/ to also block .bak-* filenames (was only blocking .bak. or .bak$)
    - Added *.bak-* pattern to .gitignore (*.bak.* pattern did not match hyphen-separated timestamps)
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 1140724..3a7a026 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,4 +11,5 @@ build/
 .next/
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
diff --git a/server.js b/server.js
index 5632d42..15630b7 100644
--- a/server.js
+++ b/server.js
@@ -162,7 +162,7 @@ require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
 // Never serve stale snapshot files (.bak / .pre-*) even if they sit in public/.
 app.use((req, res, next) => {
-  if (/\.bak(\.|$)|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.bak[\.\-]|\.bak$|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });
 app.use(express.static(path.join(__dirname, 'public')));

← 3601dc5 feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Mylarwallpaper · harden sister-site map window.open with noopener,noreferrer 503fccd →