fix: 🐛 bug which allows host header injection vuln (#103)

* fix: 🐛 bug which allows host header injection vuln * fix: 🐛 debian logrotate debconf warnings
ministryofjustice · Nov 1, 2024 · 0067542 · 0067542
1 parent fd5cbd3
commit 0067542
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/templates/values.yaml.tpl b/templates/values.yaml.tpl
@@ -105,11 +105,12 @@ controller:
     - name: logrotate
       securityContext:
         runAsGroup: 82
-      image: debian:bookworm-slim
+      image: debian:bookworm-20241016-slim
       command:
         - sh
         - -c
         - |
+          export DEBIAN_FRONTEND=noninteractive
           apt update
           apt install logrotate -y
           groupadd -g 82 82
@@ -190,7 +191,7 @@ controller:
 %{ endif ~}
     server-snippet: |
       if ($scheme != 'https') {
-        return 308 https://$host$request_uri;
+        return 308 https://$server_name$request_uri;
       }
 
     #