fix: block .bak-<timestamp> files from being served; rm leaked public/index.html.bak-20260526152130

8e1d3e356140f0b7d3520267491eb37cb2eed8df · 2026-05-30 21:28:16 -0700 · Steve Abrams

Regex in the .bak guard did not match the `.bak-YYYYMMDDHHMMSS` filename
pattern (hyphen after bak), so express.static served the backup publicly.
Widened the regex to cover `.bak-*` variants and deleted the physical file.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 8e1d3e356140f0b7d3520267491eb37cb2eed8df
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:28:16 2026 -0700

    fix: block .bak-<timestamp> files from being served; rm leaked public/index.html.bak-20260526152130
    
    Regex in the .bak guard did not match the `.bak-YYYYMMDDHHMMSS` filename
    pattern (hyphen after bak), so express.static served the backup publicly.
    Widened the regex to cover `.bak-*` variants and deleted the physical file.
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 4c892ac..95d84d7 100644
--- a/server.js
+++ b/server.js
@@ -165,7 +165,7 @@ require("./_universal-auth")(app, cfg.auth);
 // path) — these can leak prior versions of secrets, prior server logic, or
 // unredacted vendor strings. Belt-and-suspenders behind .gitignore.
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[^/]*)(\.[\w-]+)?$|\.bak\.\d+$/i.test(req.path)) return res.status(404).end();
+  if (/\.(bak[-.\d]*|pre-[^/]*)(\.[\w-]+)?$|\.bak[\.\-]\d+/i.test(req.path)) return res.status(404).end();
   next();
 });
 app.use(express.static(path.join(__dirname, 'public')));

← 18577de feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Naturalwallcoverings · Remove Big Red widget — never UX-worked, collided with Help 00d82f5 →