[Graph] Use ExternalUrl service for checking drilldown URL links

[timroes]

See #85975 for more details.

We should validate Drilldown URLs configured in Graph using this service. Not yet clear what we should do, if a configured URL breaks with this list.

@flash1293 Do you have discussed this already for TSVB, how we're handling URLs that are not in the allowlist?

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[flash1293]

@timroes The way I understood this setting is to allow everything not in the list (just how Graph and TSVB are doing it today). The issue you linked also includes this sentence:

[...] The service allows all external URLs by default [...]

If you want to build a blacklist, I guess you can do an allow: false for host * and then allow: true from there.

[timroes]

Okay, sorry then let me rephrase the question. I meant less the behavior of the list but the behavior of our apps. I.e. what would happen if a graph/tsvb drilldown contains a URL that has allow: false? Have you made any plans around that already for TSVB? Will we remove the link? Will we build an error UI showing that it's forbidden to go there? Will the UI prevent creating new links that are in the forbidden list? Will we write a migration that will remove the existing drilldowns violating that setting?

[flash1293]

Got it, good point. we didn't discuss it explicitly, I assumed it would work the same way as vega which is simply not rendering the text as link. Not sure whether a good fit for Graph

[elasticmachine]

Pinging @elastic/kibana-visualizations @elastic/kibana-visualizations-external (Team:Visualizations)