google-deepmind / google-deepmind/deepmind-research

Enable SSL Certificate Validation in video_autoencoding.ipynb for Secure Data Fetching

Open
#691 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Jupyter Notebook
Stars
15.2k
Forks
2.9k
PR merge metrics
No merged PRs in 30d

Description

Context
The notebook perceiver/colabs/video_autoencoding.ipynb currently uses ssl.create_unverified_context() to fetch videos from the UCF101 dataset. This disables SSL certificate validation, which is a security best practice violation (CWE-295: Improper Certificate Validation).
While this is not an exploitable vulnerability in a research/Colab environment, enabling certificate validation aligns with secure coding practices and prevents potential risks in other contexts (e.g., if this code is reused in production or less-controlled environments).
Current Code (Line 97):
python
Copy

unverified_context = ssl.create_unverified_context()
index = request.urlopen(UCF_ROOT, context=unverified_context).read()

Why This Matters

Security Best Practice: Certificate validation ensures data integrity and server authenticity.
Future-Proofing: If this notebook is reused in other projects, enabling validation prevents accidental security misconfigurations.
Community Standards: Open-source projects should model secure practices for contributors and users.
Proposed Fix
Replace the unverified context with the default SSL context:
python
Copy

context = ssl.create_default_context() # Enables certificate validation
index = request.urlopen(UCF_ROOT, context=context).read()

Testing: Verify that the UCF101 dataset can still be fetched successfully with this change.

Impact
Low Risk: This is a best practice improvement with minimal risk of disruption.
High Reward: Sets a precedent for secure coding in the repository and educates users on proper SSL/TLS usage.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.