Add Security Warning to links in Docs

[mashparie]

@shainaraskas jun 30: for security reasons, we plan to replace any placeholder/fake URLs with non-hostable placeholder segments.

Remove segments that make a valid URL, including prefixes (http://) and TLDs (.com).

before:

<script src="https://<your-cdn-host>.com/path/to/elastic-apm-rum.umd.min-<version>.js" crossorigin></script>

after:

<script src="<your-url>/elastic-apm-rum.umd.min-<version>.js" crossorigin></script>

The placeholder <> can be adapted to use descriptive text for its purpose. For example, a placeholder for a splunk server might look like this:

server: <your-splunk-server-url>/<path>

---

original content:

Related to: elastic/apm-agent-rum-js#1611

In recent light of finding malicious actors abusing dummy links in our Docs, we'd like to do the following additional step

• [In the affected piece(s) of documentation, include a conspicuous security warning (e.g. a bright-colored box) advising users to "refrain from following any link to dummy URLs like [include non-clickable image copy of the original dummy URL] because threat actors are known to be misusing such URLs to distribute malware".

Please let me know if this is the correct repo.

[shainaraskas]

@mashparie what do you think about adjusting the placeholders that we use to make them less vulnerable to attack?

couple of options:

1. register our own placeholder domain and use that, a la fabrikam.com

2. use a non-url format placeholder

   e.g.

   <script src="https://<your-cdn-host>.com/path/to/elastic-apm-rum.umd.min-<version>.js" crossorigin></script>
   

   becomes

   <script src="<your-url>/elastic-apm-rum.umd.min-<version>.js" crossorigin></script>
   

   or

   <script src="$URL/elastic-apm-rum.umd.min-$VERSION.js" crossorigin></script>
   

The reason I am suggesting these options instead of the note is that I believe notes of this type will reduce overall trust in our docs, and there are viable alternatives. We can also look into adding linting to ensure adherence to one of these approaches.

[mashparie]

hi @shainaraskas -- sure I believe that could still work as a solution to protect our docs from malicious use.