security: 404 guard so stale .bak/.pre-* snapshots are never served from public/

ae8c45c61ccfde33cdadceafa453f71854d8ce84 · 2026-05-18 20:49:32 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit ae8c45c61ccfde33cdadceafa453f71854d8ce84
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 18 20:49:32 2026 -0700

    security: 404 guard so stale .bak/.pre-* snapshots are never served from public/
---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index b813506..f23bd2a 100644
--- a/server.js
+++ b/server.js
@@ -134,6 +134,11 @@ app.use(express.json({ limit: "256kb" }));
 const cfg = require('../_shared/site-config').load(__dirname);
 require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
+// Never serve stale snapshot files (.bak / .pre-*) even if they sit in public/.
+app.use((req, res, next) => {
+  if (/\.bak(\.|$)|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  next();
+});
 app.use(express.static(path.join(__dirname, 'public')));
 
 app.get('/api/products', (req, res) => {

← cf0c79f chore: untrack 21 stale .bak/.pre-* snapshot files and gitig · back to Mylarwallpaper · stage2: wire microsite catalog + admin CRUD + grid/list view a004523 →