add 404-guard middleware so backup files (.bak/.pre-*) never leak via express.static even if accidentally copied into public/

4f69bb560a8854f92c950fd5065c750e6c308ea5 · 2026-05-25 21:34:01 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 4f69bb560a8854f92c950fd5065c750e6c308ea5
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon May 25 21:34:01 2026 -0700

    add 404-guard middleware so backup files (.bak/.pre-*) never leak via express.static even if accidentally copied into public/
---
 server.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server.js b/server.js
index 8d6f529..d63fe1f 100644
--- a/server.js
+++ b/server.js
@@ -144,6 +144,11 @@ try {
 }
 require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
+// 404-guard: even if a backup file ever leaks into public/, never serve it.
+app.use((req, res, next) => {
+  if (/\.(bak|bak\.\d+)$|\.pre-/i.test(req.path)) return res.status(404).end();
+  next();
+});
 app.use(express.static(path.join(__dirname, 'public')));
 
 app.get('/api/products', (req, res) => {

← 04ede70 /api/facets total now reflects FILTERED count (honors q/aest · back to Silkwallcoverings · add clean-URL routes for /care /history /sourcing /trade /vo dd4f28a →