FEATURE: Site setting for blocking onebox of URLs that redirect (#16881)

Meta topic: https://meta.discourse.org/t/prevent-to-linkify-when-there-is-a-redirect/226964/2?u=osama.

This commit adds a new site setting `block_onebox_on_redirect` (default off) for blocking oneboxes (full and inline) of URLs that redirect. Note that an initial http → https redirect is still allowed if the redirect location is identical to the source (minus the scheme of course). For example, if a user includes a link to `http://example.com/page` and the link resolves to `https://example.com/page`, then the link will onebox (assuming it can be oneboxed) even if the setting is enabled. The reason for this is a user may type out a URL (i.e. the URL is short and memorizable) with http and since a lot of sites support TLS with http traffic automatically redirected to https, so we should still allow the URL to onebox.

spec/lib/oneboxer_spec.rb

@@ -243,6 +243,97 @@ describe Oneboxer do
       end
     end
 
+    context "when block_onebox_on_redirect setting is enabled" do
+      before do
+        Discourse.cache.clear
+        SiteSetting.block_onebox_on_redirect = true
+      end
+
+      after do
+        FinalDestination.clear_https_cache!("redirects2.com")
+        FinalDestination.clear_https_cache!("redirects3.com")
+        FinalDestination.clear_https_cache!("redirects4.com")
+      end
+
+      it "doesn't return onebox if the URL redirects" do
+        stub_request(:head, "https://redirects2.com/full-onebox")
+          .to_return(
+            status: 301,
+            body: "",
+            headers: { "location" => "https://redirects2.com/real-full-onebox" }
+          )
+        stub_request(:get, "https://redirects2.com/full-onebox")
+          .to_return(
+            status: 301,
+            body: "",
+            headers: { "location" => "https://redirects2.com/real-full-onebox" }
+          )
+        result = Oneboxer.external_onebox("https://redirects2.com/full-onebox")
+        expect(result[:onebox]).to be_blank
+      end
+
+      it "allows an initial http -> https redirect if the redirect URL is identical to the original" do
+        stub_request(:get, "http://redirects3.com/full-onebox")
+          .to_return(
+            status: 301,
+            body: "",
+            headers: { "location" => "https://redirects3.com/full-onebox" }
+          )
+        stub_request(:head, "http://redirects3.com/full-onebox")
+          .to_return(
+            status: 301,
+            body: "",
+            headers: { "location" => "https://redirects3.com/full-onebox" }
+          )
+
+        stub_request(:get, "https://redirects3.com/full-onebox")
+          .to_return(
+            status: 200,
+            body: html
+          )
+        stub_request(:head, "https://redirects3.com/full-onebox")
+          .to_return(
+            status: 200,
+            body: "",
+          )
+        result = Oneboxer.external_onebox("http://redirects3.com/full-onebox")
+        onebox = result[:onebox]
+        expect(onebox).to include("https://redirects3.com/full-onebox")
+        expect(onebox).to include("Cats")
+        expect(onebox).to include("Meow")
+      end
+
+      it "doesn't allow an initial http -> https redirect if the redirect URL is different to the original" do
+        stub_request(:get, "http://redirects4.com/full-onebox")
+          .to_return(
+            status: 301,
+            body: "",
+            headers: { "location" => "https://redirects4.com/full-onebox/2" }
+          )
+        stub_request(:head, "http://redirects4.com/full-onebox")
+          .to_return(
+            status: 301,
+            body: "",
+            headers: { "location" => "https://redirects4.com/full-onebox/2" }
+          )
+
+        stub_request(:get, "https://redirects4.com/full-onebox")
+          .to_return(
+            status: 301,
+            body: "",
+            headers: { "location" => "https://redirects4.com/full-onebox/2" }
+          )
+        stub_request(:head, "https://redirects4.com/full-onebox")
+          .to_return(
+            status: 301,
+            body: "",
+            headers: { "location" => "https://redirects4.com/full-onebox/2" }
+          )
+        result = Oneboxer.external_onebox("http://redirects4.com/full-onebox")
+        expect(result[:onebox]).to be_blank
+      end
+    end
+
     it "censors external oneboxes" do
       Fabricate(:watched_word, action: WatchedWord.actions[:censor], word: "bad word")