404-guard .bak/.pre-* paths (defense-in-depth above .gitignore; nothing currently tracked but tracked-in-future would otherwise leak via express.static)

da468790c687c7767ce22de1387b3d01ea65bed6 · 2026-05-25 21:23:52 -0700 · Steve

Files touched

M server.js

Diff

commit da468790c687c7767ce22de1387b3d01ea65bed6
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:23:52 2026 -0700

    404-guard .bak/.pre-* paths (defense-in-depth above .gitignore; nothing currently tracked but tracked-in-future would otherwise leak via express.static)
---
 server.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server.js b/server.js
index 131a117..2e98158 100644
--- a/server.js
+++ b/server.js
@@ -155,6 +155,13 @@ try {
 }
 require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
+// 404-guard: never serve backup / pre-refactor snapshots from public/ (or any
+// path) — these can leak prior versions of secrets, prior server logic, or
+// unredacted vendor strings. Belt-and-suspenders behind .gitignore.
+app.use((req, res, next) => {
+  if (/\.(bak|pre-[^/]*)(\.[\w-]+)?$|\.bak\.\d+$/i.test(req.path)) return res.status(404).end();
+  next();
+});
 app.use(express.static(path.join(__dirname, 'public')));
 
 app.get('/api/products', (req, res) => {

← b6cf30f /api/facets: count FILTERED list (honor q + aesthetic) inste · back to Naturalwallcoverings · noopener,noreferrer on window.open() sister-site jump (preve c56bed8 →