From e98fef20219fcf031a516bcac0a9a11279ead84f Mon Sep 17 00:00:00 2001 From: Travis Bonnet Date: Tue, 7 Apr 2026 19:04:19 -0500 Subject: [PATCH] fix(bench): remove global SSL verification bypass in convomem_bench The module-level `ssl._create_default_https_context = ssl._create_unverified_context` disables certificate verification for ALL urllib requests in the process, not just the benchmark's HuggingFace downloads. This silently exposes the benchmark runner to MITM attacks. If a specific environment needs to skip verification (e.g. corporate proxy), users can set `PYTHONHTTPSVERIFY=0` or pass a custom ssl context per-request rather than globally patching the ssl module. Co-Authored-By: Tadao --- benchmarks/convomem_bench.py | 4 ---- 1 file changed, 4 deletions(-) diff --git a/benchmarks/convomem_bench.py b/benchmarks/convomem_bench.py index a95561568..b4b2acf68 100644 --- a/benchmarks/convomem_bench.py +++ b/benchmarks/convomem_bench.py @@ -25,7 +25,6 @@ import sys import json import shutil -import ssl import tempfile import argparse import urllib.request @@ -35,9 +34,6 @@ import chromadb -# Bypass SSL for restricted environments -ssl._create_default_https_context = ssl._create_unverified_context - sys.path.insert(0, str(Path(__file__).parent.parent)) HF_BASE = "https://huggingface.co/datasets/Salesforce/ConvoMem/resolve/main/core_benchmark/evidence_questions"