gitignore snapshot-file patterns + 404-guard middleware

cabe76a9e39c8d732dd2b1c91b11973743655a4b · 2026-05-19 21:41:35 -0700 · SteveStudio2

Broadens .gitignore to cover *.bak / *.bak.* / *.pre-* / *.orig / *.rej
so editor backups and patcher snapshots never get committed. Adds an
Express middleware before express.static that 404s any request whose
path matches those patterns, as defense-in-depth.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit cabe76a9e39c8d732dd2b1c91b11973743655a4b
Author: SteveStudio2 <steve@designerwallcoverings.com>
Date:   Tue May 19 21:41:35 2026 -0700

    gitignore snapshot-file patterns + 404-guard middleware
    
    Broadens .gitignore to cover *.bak / *.bak.* / *.pre-* / *.orig / *.rej
    so editor backups and patcher snapshots never get committed. Adds an
    Express middleware before express.static that 404s any request whose
    path matches those patterns, as defense-in-depth.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore | 5 +++++
 server.js  | 7 +++++++
 2 files changed, 12 insertions(+)

diff --git a/.gitignore b/.gitignore
index b8caf38..e94341d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,8 @@ build/
 data/*.db
 data/*.db-journal
 data/uploads/
+*.bak
+*.bak.*
+*.pre-*
+*.orig
+*.rej
diff --git a/server.js b/server.js
index 56af680..dba6bd7 100644
--- a/server.js
+++ b/server.js
@@ -351,6 +351,13 @@ app.use(session({
   saveUninitialized: true,
   cookie: { httpOnly: true, sameSite: 'lax', maxAge: 1000 * 60 * 60 * 24 * 90 }
 }));
+// Snapshot-file 404-guard: refuse to serve *.bak / *.pre-* / *.orig / *.rej
+// from static root regardless of what's on disk. Defense-in-depth against an
+// accidental rsync of an editor backup leaking server-side state to the web.
+app.use((req, res, next) => {
+  if (/\.(bak|orig|rej)(\.|$)|\.pre-/.test(req.path)) return res.status(404).end();
+  next();
+});
 app.use(express.static(path.join(__dirname, 'public')));
 
 const upload = multer({ dest: UPLOAD_DIR, limits: { fileSize: 25 * 1024 * 1024 } });

← 41ce55c add rel="noopener noreferrer" to fav-share fallback link · back to Whatsmystyle · Add per-site favicon (kills /favicon.ico 404) 89e1682 →