Avoid full bootstrap for 404s on static asset requests (#583)

Author: fballiano

public/index.php

@@ -13,6 +13,25 @@
 define('MAHO_ROOT_DIR', dirname(__DIR__));
 define('MAHO_PUBLIC_DIR', __DIR__);
 
+// Early exit for missing static assets — avoids full bootstrap just to return a 404.
+// Web servers should handle this natively, but this is a safety net for environments
+// where that's not configured (php -S dev server, FrankenPHP defaults, shared hosting).
+$requestPath = parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '/';
+if ($requestPath !== '/') {
+    $ext = strtolower(pathinfo($requestPath, PATHINFO_EXTENSION));
+    $staticExts = [
+        'jpg', 'jpeg', 'png', 'gif', 'webp', 'avif', 'svg', 'svgz', 'ico', 'bmp', 'apng',
+        'css', 'js', 'mjs', 'map', 'woff', 'woff2', 'ttf', 'otf', 'eot',
+        'mp3', 'mp4', 'ogg', 'webm', 'wav', 'flac', 'aac', 'm4a', 'm4v', 'ogv', 'mov',
+        'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx',
+        'zip', 'gz', 'tar', 'rar', '7z',
+    ];
+    if (in_array($ext, $staticExts, true)) {
+        http_response_code(404);
+        exit;
+    }
+}
+
 require MAHO_ROOT_DIR . '/vendor/autoload.php';
 
 #\Maho\Profiler::enable();