fix: block .bak-<timestamp> files from being served (regex missed hyphen-suffixed .bak extensions)

1dff83d03e0aedc2c9cada9f6943c67f45dd0c87 · 2026-05-30 21:25:11 -0700 · Steve Abrams

The backup-file guard regex did not match .bak-YYYYMMDDHHMMSS filenames because it
only checked for .bak followed by period or end-of-string. Updated to also match
.bak followed by any non-alphanumeric char, and added .bak(-...) capture in the
primary pattern. Removed public/index.html.bak-20260526152130 which was being served
as a full HTML page despite the guard.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 1dff83d03e0aedc2c9cada9f6943c67f45dd0c87
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:25:11 2026 -0700

    fix: block .bak-<timestamp> files from being served (regex missed hyphen-suffixed .bak extensions)
    
    The backup-file guard regex did not match .bak-YYYYMMDDHHMMSS filenames because it
    only checked for .bak followed by period or end-of-string. Updated to also match
    .bak followed by any non-alphanumeric char, and added .bak(-...) capture in the
    primary pattern. Removed public/index.html.bak-20260526152130 which was being served
    as a full HTML page despite the guard.
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index d531dd5..5b67c23 100644
--- a/server.js
+++ b/server.js
@@ -164,7 +164,7 @@ require("./_universal-auth")(app, cfg.auth);
 
 // Security guard: never serve snapshot/backup files from the static root.
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[^/]*)$|\.bak(\.|$)|\.pre-/i.test(req.path)) {
+  if (/\.(bak(-[^/]*)?|orig|pre-[^/]*)$/i.test(req.path) || /\.bak[^a-z0-9]/i.test(req.path)) {
     return res.status(404).send('Not found');
   }
   next();

← 1229bcf feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Vinylwallpaper · 301 redirect legacy *.html nav pages -> clean URLs (before e d8b7ebd →