Skip to content

Fully deprecate oembed endpoints#6259

Merged
juliawu merged 1 commit into
datacommonsorg:masterfrom
juliawu:deprecate-oembed
May 5, 2026
Merged

Fully deprecate oembed endpoints#6259
juliawu merged 1 commit into
datacommonsorg:masterfrom
juliawu:deprecate-oembed

Conversation

@juliawu
Copy link
Copy Markdown
Contributor

@juliawu juliawu commented May 4, 2026

Description

This PR deprecates and completely removes all implementations, routes, blueprints, templates, and experimental guides for oembed from the codebase.

The oembed and /chart endpoints were originally designed to provide content management services with a mechanism to rich-embed Data Commons web components, but are no longer supported. We got reports of XSS vulnerabilities found by an external reporter, and the decision was made to remove these endpoints instead of trying to fix it.

Changes Made

1. Core Server Blueprint Changes

  • Modified server/__init__.py: Removed oembed and oembed_chart blueprint imports and application registrations from register_routes_common().

2. Backend File & Directory Deletions

  • Deleted server/routes/oembed/chart.py (implemented the /chart embed-friendly page).
  • Deleted server/routes/oembed/oembed.py (implemented the /oembed API handler returning JSON/XML properties).
  • Deleted server/routes/oembed/ directory entirely.

3. Frontend Templates & Examples Deletions

  • Deleted server/templates/oembed_chart.html (the dedicated Jinja template providing alternate application/json+oembed and text/xml+oembed discovery headers).
  • Deleted experimental/oembed/oembed_example.html and its parent directory (a developer/user playground guide documenting oembed usage).

Verification

1. Lint and Formatting

  • Ran ./run_test.sh -f to perform fully automated code style adjustment, verifying Python files conform to yapf and isort standards.

2. Routing Validation

  • Run ./run_server.sh to spin up a local server
  • Confirmed that zero oembed or /chart routes are registered on the server. Any attempts to hit these endpoints now trigger standard 404 Not Found responses.

@gemini-code-assist
Copy link
Copy Markdown
Contributor

Warning

Gemini encountered an error creating the summary. You can try again by commenting /gemini summary.

@juliawu
Copy link
Copy Markdown
Contributor Author

juliawu commented May 4, 2026

/gemini review

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request removes the oEmbed functionality from the server. Specifically, it deletes the oEmbed and chart route definitions, removes their blueprint registrations in the main application entry point, and deletes the associated HTML templates and documentation. I have no feedback to provide.

@juliawu juliawu requested a review from nick-nlb May 4, 2026 22:41
@juliawu juliawu marked this pull request as ready for review May 4, 2026 22:41
Copy link
Copy Markdown
Contributor

@nick-nlb nick-nlb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - thanks for this Julia!

@juliawu juliawu merged commit 837d90e into datacommonsorg:master May 5, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants