Fully deprecate oembed endpoints#6259
Merged
Merged
Conversation
Contributor
|
Warning Gemini encountered an error creating the summary. You can try again by commenting |
Contributor
Author
|
/gemini review |
Contributor
There was a problem hiding this comment.
Code Review
This pull request removes the oEmbed functionality from the server. Specifically, it deletes the oEmbed and chart route definitions, removes their blueprint registrations in the main application entry point, and deletes the associated HTML templates and documentation. I have no feedback to provide.
nick-nlb
approved these changes
May 5, 2026
Contributor
nick-nlb
left a comment
There was a problem hiding this comment.
LGTM - thanks for this Julia!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR deprecates and completely removes all implementations, routes, blueprints, templates, and experimental guides for
oembedfrom the codebase.The
oembedand/chartendpoints were originally designed to provide content management services with a mechanism to rich-embed Data Commons web components, but are no longer supported. We got reports of XSS vulnerabilities found by an external reporter, and the decision was made to remove these endpoints instead of trying to fix it.Changes Made
1. Core Server Blueprint Changes
server/__init__.py: Removedoembedandoembed_chartblueprint imports and application registrations fromregister_routes_common().2. Backend File & Directory Deletions
server/routes/oembed/chart.py(implemented the/chartembed-friendly page).server/routes/oembed/oembed.py(implemented the/oembedAPI handler returning JSON/XML properties).server/routes/oembed/directory entirely.3. Frontend Templates & Examples Deletions
server/templates/oembed_chart.html(the dedicated Jinja template providing alternateapplication/json+oembedandtext/xml+oembeddiscovery headers).experimental/oembed/oembed_example.htmland its parent directory (a developer/user playground guide documenting oembed usage).Verification
1. Lint and Formatting
./run_test.sh -fto perform fully automated code style adjustment, verifying Python files conform toyapfandisortstandards.2. Routing Validation
./run_server.shto spin up a local serveroembedor/chartroutes are registered on the server. Any attempts to hit these endpoints now trigger standard404 Not Foundresponses.