← back to Thesetdecorator
fix: block .original.png backup leaks from express.static + gitignore *.original.*
9cc74407e3aa1b98090a931240c883348eecc137 · 2026-05-30 21:24:37 -0700 · SteveStudio2
12 untracked *.original.png files in public/img/seed/ were served with HTTP 200
via express.static. The existing 404 guard only blocked `.orig` (exact extension)
but not the `.original.png` variant produced by the image-processing pipeline.
Added `/\.original\.[^/]+$/` to the guard regex and `*.original.*` to .gitignore.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Files touched
Diff
commit 9cc74407e3aa1b98090a931240c883348eecc137
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date: Sat May 30 21:24:37 2026 -0700
fix: block .original.png backup leaks from express.static + gitignore *.original.*
12 untracked *.original.png files in public/img/seed/ were served with HTTP 200
via express.static. The existing 404 guard only blocked `.orig` (exact extension)
but not the `.original.png` variant produced by the image-processing pipeline.
Added `/\.original\.[^/]+$/` to the guard regex and `*.original.*` to .gitignore.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
.gitignore | 1 +
server.js | 1 +
2 files changed, 2 insertions(+)
diff --git a/.gitignore b/.gitignore
index 4bbc3d9..f5fcd89 100644
--- a/.gitignore
+++ b/.gitignore
@@ -59,6 +59,7 @@ data/demo-requests.jsonl
*.bak.*
*.pre-*
*.orig
+*.original.*
*.rej
*.swp
*~
diff --git a/server.js b/server.js
index d1dbf9f..c11f7da 100644
--- a/server.js
+++ b/server.js
@@ -68,6 +68,7 @@ app.use((req, res, next) => {
/\/\.(?:env|git|svn|hg|DS_Store|aws|ssh)\b/.test(p) ||
/\.(?:bak|orig|rej|swp|pre-[^/]+)$/.test(p) ||
/\.bak\.[^/]+$/.test(p) ||
+ /\.original\.[^/]+$/.test(p) ||
/~$/.test(p) ||
/\/_[^/]+\.tpl\.html$/.test(p)
) {
← d2e84d0 fix(pm2): raise thesetdecorator max_memory_restart 1G->2G to
·
back to Thesetdecorator
·
Link favicon.svg in head (use branded SVG, not .ico fallback 18914a3 →