server: 404 bak/pre/orig/rej/swp/tilde paths before static lookup

336eef0b681e040c1eea9c64e31932285705298b · 2026-05-19 18:33:07 -0700 · SteveStudio2

Files touched

M server.js

Diff

commit 336eef0b681e040c1eea9c64e31932285705298b
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 18:33:07 2026 -0700

    server: 404 bak/pre/orig/rej/swp/tilde paths before static lookup
---
 server.js | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/server.js b/server.js
index 9d9080c..c676bf5 100644
--- a/server.js
+++ b/server.js
@@ -113,7 +113,18 @@ async function captureShot(domain) {
   }
 }
 
+// 404-guard: never serve editor/scratch/backup detritus (.bak, .pre-*, etc.)
+// even if a stray file slips into a static-served directory. Matched against
+// the URL pathname BEFORE any file lookup.
+const JUNK_PATH_RE = /\.(bak(\..*)?|pre-[^/]*|orig|rej|swp|swo)$|~$/i;
+
 const server = http.createServer((req, res) => {
+  const pathname = (req.url || '').split('?')[0];
+  if (JUNK_PATH_RE.test(pathname)) {
+    res.writeHead(404, { 'Content-Type': 'text/plain' });
+    res.end('not found');
+    return;
+  }
   if (req.url.startsWith('/api/shot')) {
     const domain = (new URL(req.url, 'http://x').searchParams.get('domain') || '')
       .replace(/[^a-z0-9.\-]/gi, '');

← e42a811 gitignore: broaden patterns to cover bak/pre/swp/orig/rej de · back to Purelymail Fleet Viewer · viewer: add noreferrer to every target=_blank anchor 21a690a →