add 404-guard middleware for snapshot/editor file patterns before express.static

3be3c67d994009356091316b5e8f292601ce033d · 2026-05-19 21:35:27 -0700 · steve

Defense-in-depth per fleet-refactor-sweep standing rule — blocks *.bak, *.orig,
*.rej, *.swp, *.pre-*, *~ even if such a file accidentally lands in public/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 3be3c67d994009356091316b5e8f292601ce033d
Author: steve <steve@designerwallcoverings.com>
Date:   Tue May 19 21:35:27 2026 -0700

    add 404-guard middleware for snapshot/editor file patterns before express.static
    
    Defense-in-depth per fleet-refactor-sweep standing rule — blocks *.bak, *.orig,
    *.rej, *.swp, *.pre-*, *~ even if such a file accidentally lands in public/.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 server.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server.js b/server.js
index 720cc42..ae702f9 100644
--- a/server.js
+++ b/server.js
@@ -23,6 +23,16 @@ const PORT = process.env.PORT || 3877;
 // Middleware
 app.use(cors());
 app.use(express.json());
+
+// Snapshot-file 404-guard — blocks accidental serving of editor/backup files
+// even if one ever lands in public/. Standing rule (fleet-refactor-sweep).
+app.use((req, res, next) => {
+  if (/\.(bak|orig|rej|swp)(\.|$)|\.pre-|~$/i.test(req.path)) {
+    return res.status(404).end();
+  }
+  next();
+});
+
 app.use(express.static('public'));
 
 // Store active conversations

← 62c7166 snapshot: 1 file(s) changed, ~1 modified · back to Web Viewer 3877 · fix .gitignore: expand broken literal "\n" line + dedupe + a 83bda2d →