harden: noopener on external links + .bak/.pre- 404-guard

520c61dd88a05ead5cb3fffb80f490b6c09a13d4 · 2026-05-19 08:08:49 -0700 · SteveStudio2

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M public/index.html
M server.js

Diff

commit 520c61dd88a05ead5cb3fffb80f490b6c09a13d4
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 08:08:49 2026 -0700

    harden: noopener on external links + .bak/.pre- 404-guard
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore        | 3 +++
 public/index.html | 4 ++--
 server.js         | 6 ++++++
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 08240ae..bfd17aa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,6 @@ tmp/
 .DS_Store
 dist/
 build/
+*.bak
+*.bak.*
+*.pre-*
diff --git a/public/index.html b/public/index.html
index 3d01b16..5a15b26 100644
--- a/public/index.html
+++ b/public/index.html
@@ -280,7 +280,7 @@ body {
   <nav class="header-nav">
     <a href="#glossary">Trade Terms</a>
     <a href="#cta">Trade Account</a>
-    <a href="https://designerwallcoverings.com" target="_blank">DW</a>
+    <a href="https://designerwallcoverings.com" target="_blank" rel="noopener noreferrer">DW</a>
   </nav>
   <button class="theme-toggle" id="themeToggle" aria-label="Toggle dark/light mode">
     <svg id="iconSun" xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="display:none"><circle cx="12" cy="12" r="5"/><line x1="12" y1="1" x2="12" y2="3"/><line x1="12" y1="21" x2="12" y2="23"/><line x1="4.22" y1="4.22" x2="5.64" y2="5.64"/><line x1="18.36" y1="18.36" x2="19.78" y2="19.78"/><line x1="1" y1="12" x2="3" y2="12"/><line x1="21" y1="12" x2="23" y2="12"/><line x1="4.22" y1="19.78" x2="5.64" y2="18.36"/><line x1="18.36" y1="5.64" x2="19.78" y2="4.22"/></svg>
@@ -511,7 +511,7 @@ body {
   <div class="cta-section">
     <h2>Trade accounts, free samples, and hands-on specification support</h2>
     <p>Designer Wallcoverings works directly with interior designers, architects, and commercial specifiers. Open a trade account, request memo samples on any of 8,000+ SKUs, and get yardage calculations from our dedicated specification team.</p>
-    <a href="https://designerwallcoverings.com" target="_blank" class="cta-btn">Open a Trade Account</a>
+    <a href="https://designerwallcoverings.com" target="_blank" rel="noopener noreferrer" class="cta-btn">Open a Trade Account</a>
   </div>
 </section>
 
diff --git a/server.js b/server.js
index 4ce0c9c..c61d60b 100644
--- a/server.js
+++ b/server.js
@@ -3,6 +3,12 @@ const path = require('path');
 const app = express();
 const PORT = process.env.PORT || 9902;
 
+// Block snapshot/backup files from ever serving out of the static root
+app.use((req, res, next) => {
+  if (/\.(bak|pre-)/i.test(req.path)) return res.status(404).end();
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public')));
 
 app.get('/health', (req, res) => res.json({ status: 'ok', site: 'wallpaperglossary.com' }));

← 3ccdc27 embed Big Red customer chat (lower-left, retail mode, vendor · back to Wallpaperglossary · add corner-nav.js — universal top-right nav per _shared/corn 2af6323 →