{"record":{"id":"7647efb450c5f27b","repo":"sgl-project/sglang","slug":"invalid-hugging-face-field-name-path-r","errorCode":null,"errorMessage":"Invalid Hugging Face {field_name}: {path!r}","messagePattern":"Invalid Hugging Face (.+?): (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/sglang/multimodal_gen/runtime/weights/source.py","lineNumber":55,"sourceCode":"@dataclass(frozen=True)\nclass ResolvedWeight:\n    inventory: WeightInventory\n    selected_file: str\n\n\ndef is_explicit_weight_file_reference(source: str) -> bool:\n    \"\"\"Whether a component override names one weight file, not a component root.\"\"\"\n    expanded = os.path.expanduser(source)\n    if os.path.isdir(expanded):\n        return False\n    return urlparse(source).path.lower().endswith(_WEIGHT_SUFFIXES)\n\n\ndef _validate_relative_hub_path(path: str, field_name: str) -> str:\n    normalized = str(PurePosixPath(path))\n    pure_path = PurePosixPath(normalized)\n    if not path or pure_path.is_absolute() or \"..\" in pure_path.parts:\n        raise ValueError(f\"Invalid Hugging Face {field_name}: {path!r}\")\n    return normalized\n\n\ndef _merge_revision(url_revision: str | None, revision: str | None) -> str | None:\n    if url_revision is not None and revision is not None and url_revision != revision:\n        raise ValueError(\n            f\"Weight URL pins revision {url_revision!r}, which conflicts with \"\n            f\"revision {revision!r}\"\n        )\n    return url_revision or revision\n\n\ndef _parse_huggingface_url(source: str, revision: str | None) -> WeightSource:\n    parsed = urlparse(source)\n    if parsed.netloc.lower() not in (\"huggingface.co\", \"www.huggingface.co\"):\n        raise ValueError(\n            \"Only huggingface.co weight URLs are supported; use a local path \"\n            \"or an owner/repo reference for other sources\"","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/multimodal_gen/runtime/weights/source.py#L37-L73","documentation":"Raised by _validate_relative_hub_path (via _parse_huggingface_url / parse_weight_source) when a subfolder or filename extracted from a Hugging Face URL is empty, absolute, or contains '..'. Only safe, relative, normalized paths are accepted as hub subpaths.","triggerScenarios":"parse_weight_source on a URL like https://huggingface.co/repo/tree//sub or one containing '..' segments (e.g. /repo/tree/main/../secret), or an unquoted path that normalizes to empty.","commonSituations":"Hand-editing weight URLs, copy-pasting URLs with traversal segments, or programmatically joining subfolder paths that accidentally produce '..' or leading '/'.","solutions":["Remove '..' segments and leading slashes from the URL subpath","Point at a real subfolder/file path inside the repo, or drop the subfolder part entirely","Alternatively use a local path plus an explicit subfolder argument instead of a crafted URL"],"exampleFix":"# before\nparse_weight_source(\"https://huggingface.co/org/repo/tree/main/../diffusers\")\n# after\nparse_weight_source(\"https://huggingface.co/org/repo/tree/main/diffusers\")","handlingStrategy":"validation","validationCode":"from pathlib import PurePosixPath\ndef safe_hub_subpath(p: str) -> bool:\n    pp = PurePosixPath(str(p))\n    return bool(p) and not pp.is_absolute() and \"..\" not in pp.parts","typeGuard":"def is_valid_hub_path(path: str) -> bool:\n    pp = PurePosixPath(path)\n    return bool(path) and not path.startswith(\"/\") and \"..\" not in path.split(\"/\")","tryCatchPattern":"try:\n    src = parse_weight_source(url)\nexcept ValueError as e:\n    if \"Invalid Hugging Face\" in str(e):\n        src = parse_weight_source(sanitize(url))\n    else:\n        raise","preventionTips":["Never build hub paths by string concatenation with user input","Strip '..' and leading '/' before forming URLs"],"tags":["huggingface","weights","url-parsing","path-traversal"],"backgroundTag":"invalid-url-path-segment","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T06:17:29.519Z"}