Skip to content

fix(security): remove insecure SSL verification bypass in dataset downloaders#1108

Merged
rgsl888prabhu merged 2 commits intoNVIDIA:mainfrom
rgsl888prabhu:fix/sonarqube-ssl-verification
Apr 16, 2026
Merged

fix(security): remove insecure SSL verification bypass in dataset downloaders#1108
rgsl888prabhu merged 2 commits intoNVIDIA:mainfrom
rgsl888prabhu:fix/sonarqube-ssl-verification

Conversation

@rgsl888prabhu
Copy link
Copy Markdown
Collaborator

Summary

  • Remove ssl.CERT_NONE and check_hostname = False bypass for plato.asu.edu URLs in dataset download scripts
  • The site has a valid SSL certificate — the bypass was unnecessary and flagged by SonarQube as 2 Medium-severity vulnerabilities
  • Clean up unused import ssl

Fixes SonarQube rules python:S4830 and python:S5527 (the only 2 open security vulnerabilities in the report).

Test plan

  • Run regression/get_datasets.py and verify plato.asu.edu downloads succeed without SSL bypass
  • Run benchmarks/linear_programming/utils/get_datasets.py and verify same

…nloaders

Remove ssl.CERT_NONE and check_hostname=False bypass for plato.asu.edu
URLs. The site has a valid SSL certificate so the bypass is unnecessary.

Fixes SonarQube vulnerabilities:
  - python:S4830 (server certificate verification disabled)
  - python:S5527 (server hostname verification disabled)
@rgsl888prabhu rgsl888prabhu requested a review from a team as a code owner April 15, 2026 19:53
@rgsl888prabhu rgsl888prabhu requested a review from tmckayus April 15, 2026 19:53
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 15, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4ac0d007-778f-4104-9f34-6eede1ba9f31

📥 Commits

Reviewing files that changed from the base of the PR and between 1f2fb22 and b08ae44.

📒 Files selected for processing (2)
  • benchmarks/linear_programming/utils/get_datasets.py
  • regression/get_datasets.py

📝 Walkthrough

Walkthrough

Removes SSL certificate verification bypass logic that was conditionally applied to plato.asu.edu URLs in both files. Downloads now uniformly use default urllib.request.urlopen() behavior for all domains, eliminating custom SSL context handling and associated conditional branching.

Changes

Cohort / File(s) Summary
SSL Bypass Removal
benchmarks/linear_programming/utils/get_datasets.py, regression/get_datasets.py
Removed conditional SSL context that disabled hostname checking and certificate verification for plato.asu.edu domains. Eliminated ssl module import and replaced context manager with direct urllib.request.urlopen() call, unifying download behavior across all URLs.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately describes the main change: removing insecure SSL verification bypass logic from dataset downloaders, which is the core change in both modified files.
Description check ✅ Passed The description is directly related to the changeset, explaining the removal of SSL bypass logic, the rationale (plato.asu.edu has valid certificate), SonarQube violations addressed, and a test plan to verify the changes.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

@rgsl888prabhu rgsl888prabhu self-assigned this Apr 15, 2026
@rgsl888prabhu rgsl888prabhu added non-breaking Introduces a non-breaking change improvement Improves an existing functionality labels Apr 15, 2026
@rgsl888prabhu
Copy link
Copy Markdown
Collaborator Author

/merge

@rgsl888prabhu rgsl888prabhu merged commit 46b809a into NVIDIA:main Apr 16, 2026
308 of 313 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

improvement Improves an existing functionality non-breaking Introduces a non-breaking change

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants