fix: block .bak-TIMESTAMP backup files from being served + add .bak- to .gitignore

e76c4449d82149749773c7789c43c495587cd9e8 · 2026-05-30 21:27:10 -0700 · Steve Abrams

public/index.html.bak-20260526152130 was accessible via HTTP (200) because
the bak-guard regex only matched .bak followed by a dot or EOL, not .bak-*.
Updated regex to /\.bak(?:[\.\-]|$)/ to cover all three variants (.bak, .bak.,
.bak-). Removed the leaked file and added *.bak-* to .gitignore.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit e76c4449d82149749773c7789c43c495587cd9e8
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:27:10 2026 -0700

    fix: block .bak-TIMESTAMP backup files from being served + add *.bak-* to .gitignore
    
    public/index.html.bak-20260526152130 was accessible via HTTP (200) because
    the bak-guard regex only matched .bak followed by a dot or EOL, not .bak-*.
    Updated regex to /\.bak(?:[\.\-]|$)/ to cover all three variants (.bak, .bak.,
    .bak-). Removed the leaked file and added *.bak-* to .gitignore.
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 7e2084a..caca2c7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,5 +11,6 @@ build/
 .next/
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
 .deploy.conf
diff --git a/server.js b/server.js
index cd18ca9..16cc15a 100644
--- a/server.js
+++ b/server.js
@@ -153,7 +153,7 @@ app.use(express.json({ limit: '256kb' }));
 // alongside .gitignore — even if a snapshot escapes the ignore list, it can't
 // be fetched over HTTP.
 app.use((req, res, next) => {
-  if (/\.(?:bak)(?:\.|$)|\.pre-/i.test(req.path)) return res.status(404).end();
+  if (/\.bak(?:[\.\-]|$)|\.pre-/i.test(req.path)) return res.status(404).end();
   next();
 });
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js

← 8d0ed49 feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Retrowalls · noopener,noreferrer on sister-site map window.open(_blank) 4e776b9 →