[7.17] [Docs] Scan for unsafe URLs and replace with placeholders (#230083) (#230240)

florent-leborgne · web-flow · commit 673f544ed841 · 2025-08-01T14:30:22.000Z
# Backport This will backport the following commits from `8.19` to `7.17`: - [[Docs] Scan for unsafe URLs and replace with placeholders (#230083)](#230083)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)
diff --git a/docs/developer/contributing/development-tests.asciidoc b/docs/developer/contributing/development-tests.asciidoc
@@ -115,5 +115,5 @@ something simple, e.g. "`computer`".
 * Run {kib} with `yarn start --host=computer.local` (substituting
 your computer name).
 * Now you can run your VM, open the browser, and navigate to
-`http://computer.local:5601` to test {kib}.
+`<COMPUTER_NAME>.local:5601` to test {kib}.
 * Alternatively you can use browserstack
diff --git a/docs/management/connectors/pre-configured-connectors.asciidoc b/docs/management/connectors/pre-configured-connectors.asciidoc
@@ -24,12 +24,12 @@ two out-of-the box connectors: <<slack-action-type, Slack>> and <<webhook-action
       actionTypeId: .slack      <2>
       name: 'Slack #xyz'        <3>
       secrets:
-        webhookUrl: 'https://hooks.slack.com/services/abcd/efgh/ijklmnopqrstuvwxyz'
+        webhookUrl: '<WEBHOOK_URL>' <1>
     webhook-service:
       actionTypeId: .webhook
       name: 'Email service'
       config:                   <4>
-        url: 'https://email-alert-service.elastic.co'
+        url: '<SERVICE_URL>' <1>
         method: post
         headers:
           header1: value1
diff --git a/docs/management/field-formatters/url-formatter.asciidoc b/docs/management/field-formatters/url-formatter.asciidoc
@@ -12,7 +12,7 @@ For example, when:
 
 * A field contains a user ID
 * A field uses the `Url` field formatter
-* The URI template is `http://company.net/profiles?user_id={­{value}­}`
+* The URI template is `<BASE_URL>/profiles?user_id={­{value}­}`
 
 The resulting URL replaces `{{value}}` with the user ID from the field.
 
diff --git a/docs/maps/connect-to-ems.asciidoc b/docs/maps/connect-to-ems.asciidoc
@@ -213,7 +213,7 @@ services:
   {hosted-ems}:
     image: {ems-docker-image}
     environment:
-      ELASTICSEARCH_HOST: http://elasticsearch.example.org
+      ELASTICSEARCH_HOST: <ELASTICSEARCH_HOST_URL>
       ELASTICSEARCH_USERNAME: 'ems'
       ELASTICSEARCH_PASSWORD: 'changeme'
 ----------------------------------------------------------
@@ -235,7 +235,7 @@ TIP: The available basemaps and boundaries can be explored from the `/maps` endp
 [[elastic-maps-server-kibana]]
 ==== Kibana configuration
 
-With {hosted-ems} running, add the `map.emsUrl` configuration key in your <<settings, kibana.yml>> file pointing to the root of the service. This setting will point {kib} to request EMS basemaps and boundaries from {hosted-ems}. Typically this will be the URL to the <<ems-host,host and port>> of {hosted-ems}. For example, `map.emsUrl: https://my-ems-server:8080`. 
+With {hosted-ems} running, add the `map.emsUrl` configuration key in your <<settings, kibana.yml>> file pointing to the root of the service. This setting will point {kib} to request EMS basemaps and boundaries from {hosted-ems}. Typically this will be the URL to the <<ems-host,host and port>> of {hosted-ems}. For example, `map.emsUrl: <BASE_URL>:8080`. 
 
 
 [float]
diff --git a/docs/settings/alert-action-settings.asciidoc b/docs/settings/alert-action-settings.asciidoc
@@ -72,7 +72,7 @@ xpack.actions.customHostSettings:
           -----END CERTIFICATE-----
     smtp:
       requireTLS: true
-  - url: https://webhook.example.com
+  - url: <WEBHOOK_URL>
     ssl:
       verificationMode: 'none'
 --
diff --git a/docs/settings/reporting-settings.asciidoc b/docs/settings/reporting-settings.asciidoc
@@ -190,35 +190,35 @@ The rule objects are evaluated sequentially from the beginning to the end of the
 
 [source,yaml]
 -------------------------------------------------------
-# Only allow requests to placeholder.com
+# Only allow requests to elastic.co
 xpack.reporting.capture.networkPolicy:
-  rules: [ { allow: true, host: "placeholder.com" } ] 
+  rules: [ { allow: true, host: "elastic.co" } ]
 -------------------------------------------------------
 
 [source,yaml]
 -------------------------------------------------------
-# Only allow requests to https://placeholder.com 
+# Only allow requests to https://elastic.co
 xpack.reporting.capture.networkPolicy:
-  rules: [ { allow: true, host: "placeholder.com", protocol: "https:" } ] 
+  rules: [ { allow: true, host: "elastic.co", protocol: "https:" } ]
 -------------------------------------------------------
 
 A final `allow` rule with no host or protocol allows all requests that are not explicitly denied:
 
 [source,yaml]
 -------------------------------------------------------
-# Denies requests from http://placeholder.com, but anything else is allowed.
+# Denies requests from http://elastic.co, but anything else is allowed.
 xpack.reporting.capture.networkPolicy:
-  rules: [{ allow: false, host: "placeholder.com", protocol: "http:" }, { allow: true }];
+  rules: [{ allow: false, host: "elastic.co", protocol: "http:" }, { allow: true }];
 -------------------------------------------------------
 
 A network policy can be composed of multiple rules:
 
 [source,yaml]
 -------------------------------------------------------
-# Allow any request to http://placeholder.com but for any other host, https is required
+# Allow any request to http://elastic.co but for any other host, https is required
 xpack.reporting.capture.networkPolicy
   rules: [
-    { allow: true, host: "placeholder.com", protocol: "http:" },
+    { allow: true, host: "elastic.co", protocol: "http:" },
     { allow: true, protocol: "https:" },
   ]
 -------------------------------------------------------
diff --git a/docs/setup/access.asciidoc b/docs/setup/access.asciidoc
@@ -14,7 +14,7 @@ include::{docs-root}/shared/cloud/ess-getting-started.asciidoc[]
 
 If you are using a self-managed deployment, access {kib} through the web application on port 5601.
 
-. Point your web browser to the machine where you are running {kib} and specify the port number. For example, `localhost:5601` or `http://YOURDOMAIN.com:5601`.
+. Point your web browser to the machine where you are running {kib} and specify the port number. For example, `localhost:5601` or `<HOST_URL>:5601`.
 +
 To remotely connect to {kib}, set <<server-host,server.host>> to a non-loopback address.
 
diff --git a/docs/setup/docker.asciidoc b/docs/setup/docker.asciidoc
@@ -146,7 +146,7 @@ services:
     image: {docker-image}
     environment:
       SERVER_NAME: kibana.example.org
-      ELASTICSEARCH_HOSTS: '["http://es01:9200","http://es02:9200","http://es03:9200"]'
+      ELASTICSEARCH_HOSTS: '["<HOST_1>:9200","<HOST_2>:9200","<HOST_3>:9200"]'
 ----------------------------------------------------------
 
 Since environment variables are translated to CLI arguments, they take
diff --git a/docs/user/monitoring/monitoring-kibana.asciidoc b/docs/user/monitoring/monitoring-kibana.asciidoc
@@ -93,7 +93,7 @@ ability to access your monitoring data. It also prevents monitoring activities
 from impacting the performance of your production cluster.
 
 If {security-features} are enabled on the production cluster, use an HTTPS
-URL such as `https://<your_production_cluster>:9200` in this setting.
+URL such as `<PRODUCTION_CLUSTER_URL>:9200` in this setting.
 ===============================
 
 --
diff --git a/docs/user/monitoring/monitoring-metricbeat.asciidoc b/docs/user/monitoring/monitoring-metricbeat.asciidoc
@@ -175,7 +175,7 @@ configuration file (`metricbeat.yml`):
 ----------------------------------
 output.elasticsearch:
   # Array of hosts to connect to.
-  hosts: ["http://es-mon-1:9200", "http://es-mon2:9200"] <1>
+  hosts: ["<HOST_1>:9200", "<HOST_2>:9200"] <1>
 
   # Optional protocol and basic auth credentials.
   #protocol: "https"
@@ -187,7 +187,7 @@ output.elasticsearch:
 
 If you configured the monitoring cluster to use encrypted communications, you
 must access it via HTTPS. For example, use a `hosts` setting like
-`https://es-mon-1:9200`.
+`<HOST_URL>:9200`.
 
 IMPORTANT: The {es} {monitor-features} use ingest pipelines. The
 cluster that stores the monitoring data must have at least one node with the
diff --git a/docs/user/plugins.asciidoc b/docs/user/plugins.asciidoc
@@ -128,7 +128,7 @@ It also respects the `no_proxy` environment variable to exclude specific URLs fr
 You can specify the environment variable directly when installing plugins:
 
 [source,shell]
-$ http_proxy="http://proxy.local:4242" bin/kibana-plugin install <package name or URL>
+$ http_proxy="<PROXY_URL>.local:4242" bin/kibana-plugin install <package name or URL>
 
 [float]
 [[update-remove-plugin]]
diff --git a/docs/user/production-considerations/production.asciidoc b/docs/user/production-considerations/production.asciidoc
@@ -88,8 +88,8 @@ In kibana.yml:
 [source,js]
 --------
 elasticsearch.hosts:
-  - http://elasticsearch1:9200
-  - http://elasticsearch2:9200
+  - <ES_HOST_1>:9200
+  - <ES_HOST_2>:9200
 --------
 
 Related configurations include `elasticsearch.sniffInterval`, `elasticsearch.sniffOnStart`, and `elasticsearch.sniffOnConnectionFault`.
diff --git a/docs/user/reporting/script-example.asciidoc b/docs/user/reporting/script-example.asciidoc
@@ -9,7 +9,7 @@ curl \
 -XPOST \ <1>
 -u elastic \ <2>
 -H 'kbn-xsrf: true' \ <3>
-'http://0.0.0.0:5601/api/reporting/generate/csv?jobParams=...' <4>
+'<KIBANA_HOST>:5601/api/reporting/generate/csv?jobParams=...' <4>
 ---------------------------------------------------------
 
 <1> The required `POST` method.
diff --git a/docs/user/reporting/watch-example.asciidoc b/docs/user/reporting/watch-example.asciidoc
@@ -19,7 +19,7 @@ PUT _watcher/watch/error_report
         "attachments" : {
           "error_report.pdf" : {
             "reporting" : {
-              "url": "http://0.0.0.0:5601/api/reporting/generate/printablePdf?jobParams=...", <2>
+              "url": "<KIBANA_HOST>:5601/api/reporting/generate/printablePdf?jobParams=...", <2>
               "retries":40, <3>
               "interval":"15s", <4>
               "auth":{ <5>
diff --git a/docs/user/security/authentication/index.asciidoc b/docs/user/security/authentication/index.asciidoc
@@ -50,7 +50,7 @@ xpack.security.authc.providers:
     order: 1
     realm: saml1
     description: "Log in with SSO"
-    icon: "https://my-company.xyz/saml-logo.svg"
+    icon: "<ICON_URL>"
   saml.saml2:
     order: 2
     realm: saml2

-Original file line number
+Diff line change
 * A field contains a user ID
 * A field uses the `Url` field formatter
 -* The URI template is `http://company.net/profiles?user_id={{value}}`
 +* The URI template is `<BASE_URL>/profiles?user_id={{value}}`
 The resulting URL replaces `{{value}}` with the user ID from the field.
Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,7 @@ include::{docs-root}/shared/cloud/ess-getting-started.asciidoc[]`
`14`	`14`
`15`	`15`	`If you are using a self-managed deployment, access {kib} through the web application on port 5601.`
`16`	`16`
`17`		-. Point your web browser to the machine where you are running {kib} and specify the port number. For example, `localhost:5601` or `http://YOURDOMAIN.com:5601`.
	`17`	+. Point your web browser to the machine where you are running {kib} and specify the port number. For example, `localhost:5601` or `<HOST_URL>:5601`.
`18`	`18`	`+`
`19`	`19`	`To remotely connect to {kib}, set <<server-host,server.host>> to a non-loopback address.`
`20`	`20`