<!-- Sanitized reference copy. Original comments removed; OAuth domains generalized.
     Logic is otherwise unchanged and includes known review issues.
     Read README.md and the draft Technical Review Notes before use. -->

<group name="gitlab,authentication,oauth,">

  <rule id="110041" level="12">
    <decoded_as>json</decoded_as>

    <field name="controller" type="pcre2">^OmniauthCallbacksController$</field>
    <action type="pcre2">^google_oauth2$</action>
    <status type="pcre2">^302$</status>

    <match type="pcre2" negate="yes">\{\s*"key"\s*:\s*"hd"\s*,\s*"value"\s*:\s*"example\.(?:org|net)"\s*\}|\{\s*"value"\s*:\s*"example\.(?:org|net)"\s*,\s*"key"\s*:\s*"hd"\s*\}</match>

    <description>GitLab Google OAuth callback with unapproved or missing hosted-domain parameter: $(meta.user) from $(remote_ip), correlation $(correlation_id)</description>

    <mitre>
      <id>T1078</id>
    </mitre>

    <group>oauth,access_control,unauthorized_domain,</group>
  </rule>

</group>
