Open redirect: Slack

type.inbound
and 0 < length(body.links) < 10
and sender.email.domain.root_domain not in~ (
  'atlassian.net',
  'slack.com',
  'soundtrap.com'
)
and any(body.links,
        .href_url.domain.domain == 'slack-redir.net'
        and strings.ilike(.href_url.query_params, '*url=*')
)