guard static-file routes against .bak/.pre-/.orig snapshot leaks

c5daa13ab73517de836956d7efc52c0facbc3cdc · 2026-05-19 21:41:30 -0700 · Steve Abrams

Express middleware returns 404 for any path ending in .bak, .pre-*,
.orig, .swp, .tmp (with optional suffix), regardless of whether the
file exists in public/. Also broadens .gitignore to cover the same
patterns and fixes a literal-\\n malformed first line that was
leaving node_modules/ etc untracked unless re-listed below.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit c5daa13ab73517de836956d7efc52c0facbc3cdc
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 21:41:30 2026 -0700

    guard static-file routes against .bak/.pre-/.orig snapshot leaks
    
    Express middleware returns 404 for any path ending in .bak, .pre-*,
    .orig, .swp, .tmp (with optional suffix), regardless of whether the
    file exists in public/. Also broadens .gitignore to cover the same
    patterns and fixes a literal-\\n malformed first line that was
    leaving node_modules/ etc untracked unless re-listed below.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore | 31 +++++++++++++++++++------------
 server.js  |  8 ++++++++
 2 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/.gitignore b/.gitignore
index 4364691..5fdd754 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,15 +1,22 @@
-node_modules/\n.next/\ndist/\n.env\n*.log
-.env.local
-.env.*.local
-.env.*
+node_modules/
+.next/
+dist/
+build/
 tmp/
 .DS_Store
-build/
-*.bak
-
-# Standing-rule additions (2026-05-07)
-node_modules/
-.env*
 *.log
-dist/
-.next/
+
+# Env files
+.env
+.env.*
+.env.local
+.env.*.local
+
+# Snapshot / backup / editor cruft (standing rule)
+*.bak
+*.bak.*
+*.pre-*
+*.pre-*.*
+*.orig
+*.swp
+.~*
diff --git a/server.js b/server.js
index f673713..d1d3078 100644
--- a/server.js
+++ b/server.js
@@ -55,6 +55,14 @@ app.use(session({
   }
 }));
 
+// Guard: never serve snapshot/backup files even if accidentally committed under public/
+app.use((req, res, next) => {
+  if (/\.(bak|pre-[\w.-]+|orig|swp|tmp)(\.[\w.-]+)?$/i.test(req.path) || /\/\.(pre-|bak)/i.test(req.path)) {
+    return res.status(404).json({ success: false, error: 'Not found' });
+  }
+  next();
+});
+
 // Static files - disable caching
 app.use(express.static(path.join(__dirname, 'public'), {
   etag: false,

← 9713e54 add rel=noopener noreferrer to all target=_blank external li · back to Wine Finder · persist search-results sort selection to localStorage 62b92a0 →