4ada1541900539ce585a26642eecc7e8e56d16f6

Author
Marc Cornellà <marc@mcornella.com>
Committer
Marc Cornellà <marc@mcornella.com>
Date

Message

chore(installer): only serve installer in / and /install.sh

This avoids false positive detections on other bruteforced paths,
such as .zsh_history or others, which eventually result in
automated false vulnerability submissions.

Diff

 1diff --git a/.github/workflows/installer/vercel.json b/.github/workflows/installer/vercel.json
 2index 524dc3c0f280f20621f774463403e4ab3b785c65..88ec18725f925dad319bf229493770001569d4b8 100644
 3--- a/.github/workflows/installer/vercel.json
 4+++ b/.github/workflows/installer/vercel.json
 5@@ -1,7 +1,7 @@
 6 {
 7   "headers": [
 8     {
 9-      "source": "/((?!favicon.ico).*)",
10+      "source": "/(|install.sh)",
11       "headers": [
12         {
13           "key": "Content-Type",
14@@ -16,7 +16,7 @@
15   ],
16   "rewrites": [
17     {
18-      "source": "/((?!favicon.ico|install.sh).*)",
19+      "source": "/",
20       "destination": "/install.sh"
21     }
22   ]