fix(security): 404-guard for .bak/.pre-* editor snapshots in static root

f88113a324285f045c0aea0b0489b9a9a649ef31 · 2026-05-19 15:14:31 -0700 · Steve Abrams

Stray *.bak/*.bak.*/*.pre-* files under public/ should never be reachable
via HTTP. Adds an Express middleware that returns 404 for any path matching
those snapshot patterns, so the public static mount can't accidentally
leak prior revisions of index.html or other pages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit f88113a324285f045c0aea0b0489b9a9a649ef31
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 15:14:31 2026 -0700

    fix(security): 404-guard for .bak/.pre-* editor snapshots in static root
    
    Stray *.bak/*.bak.*/*.pre-* files under public/ should never be reachable
    via HTTP. Adds an Express middleware that returns 404 for any path matching
    those snapshot patterns, so the public static mount can't accidentally
    leak prior revisions of index.html or other pages.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/server.js b/server.js
index c8fc5c3..7069d70 100644
--- a/server.js
+++ b/server.js
@@ -133,6 +133,15 @@ function sortProducts(list, mode) {
 
 app.use(helmet({ contentSecurityPolicy: false }));
 app.use(express.json({ limit: '256kb' }));
+
+// Hard 404-guard for editor snapshot files (.bak / .bak.* / .pre-*) so a
+// stray on-disk backup under public/ never leaks via static. Defense in depth
+// alongside .gitignore — even if a snapshot escapes the ignore list, it can't
+// be fetched over HTTP.
+app.use((req, res, next) => {
+  if (/\.(?:bak)(?:\.|$)|\.pre-/i.test(req.path)) return res.status(404).end();
+  next();
+});
 // Universal contact module — modals, /api/send-inquiry, /api/send-sample, /zd-loader.js
 require('./_universal-contact')(app, { siteName: "retrowalls", zdColor: "#C9A14B", zdPosition: 'right' });
 require('./_universal-auth')(app, { siteName: "retrowalls" });

← f782674 fix(api): /api/facets total counts the served niche list, no · back to Retrowalls · chore(repo): untrack editor snapshots and broaden gitignore cd1cf67 →