file-missing-nginx-xss-protection: Missing Nginx XSS Protection

id: file-missing-nginx-xss-protection

info:
  name: Missing Nginx XSS Protection
  author: pussycat0x
  severity: high
  description: |
    Ensures that XSS protection is enabled in Nginx by checking for the 'X-XSS-Protection' header.
  reference:
    - https://wiki.devsecopsguides.com/docs/checklists/nginx/
    - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
  metadata:
    verified: true
  tags: audit,file,nginx,hardening

file:
  - extensions:
      - conf

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "http"
          - "events"
        condition: and

      - type: word
        words:
          - 'add_header X-XSS-Protection'
          - 'mode=block'
        condition: and
        negative: true
# digest: 4a0a0047304502203fd4524eeb1648448330a15368b0b044eacc605b736f50597020491cf5537ab80221009089e89873ef07800646393299c6ceaaae76b666097ce8106a4ba804ce271907:922c64590222798bb761d5b6d8e72950