viewer: 404-guard snapshot/backup paths from static root

0aa9c0c398396568d1ea4d99a141b901f95ac6f4 · 2026-05-19 17:33:46 -0700 · Steve

Block requests for *.bak, *.bak.*, *.pre-*, *.orig from being served
by express.static even if such a file is accidentally placed in
public/. Returns 404 before static middleware sees the path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M viewer.js

Diff

commit 0aa9c0c398396568d1ea4d99a141b901f95ac6f4
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue May 19 17:33:46 2026 -0700

    viewer: 404-guard snapshot/backup paths from static root
    
    Block requests for *.bak, *.bak.*, *.pre-*, *.orig from being served
    by express.static even if such a file is accidentally placed in
    public/. Returns 404 before static middleware sees the path.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 viewer.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/viewer.js b/viewer.js
index 8167001..6d0ac47 100644
--- a/viewer.js
+++ b/viewer.js
@@ -18,6 +18,15 @@ app.use((req, res, next) => {
   res.status(401).send('auth required');
 });
 
+// 404-guard: never serve snapshot/backup files even if one accidentally
+// lands in public/. Matches *.bak, *.bak.<anything>, *.pre-*, *.orig.
+app.use((req, res, next) => {
+  if (/\.(bak|orig)(\.|$)|\.pre-/i.test(req.path)) {
+    return res.status(404).send('not found');
+  }
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public')));
 
 app.listen(PORT, '0.0.0.0', () => {

← 0d5209c gitignore: broaden snapshot/backup patterns · back to The Ai Factory · (newest)