Resolve federated objects from other instances via redirect (fixes #3129)

[Nutomic]

Works in testing. Depends on LemmyNet/activitypub-federation-rust#76 but that could possibly introduce security risks.

[Nutomic]

Okay this is good to merge, I cant think of any concrete way this could be used for an attack, and its a major usability improvement. Also added an api test.

[dessalines]

I'm not sure if I resolved the correct version of your crate, if it passes then I spose we're good.

[phiresky]

Here's some articles about potential issues with open/user-editable redirects :

http://projects.webappsec.org/w/page/13246981/URL%20Redirector%20Abuse

https://developers.google.com/search/blog/2009/01/open-redirect-urls-is-your-site-being

tl;dr: it can make phishing easier because people think they are still on a trusted site but in reality were redirected to a phishing / scam site

[Nutomic]

This case is a bit different because the redirects are only served for fetching Activitypub objects with Accept: application/activity+json header. I dont think a browser will ever hit that endpoint for a normal <a href>.

Looks like I'll need to add a lemmy_utils+chrono dependency to lemmy_api_common with default feature set. If restructuring the files would be better I'd appreciate pointers.

Not sure what this is about or how it relates to the PR.

[phiresky]

Sorry, I commented on the wrong PR :/