sgl-project/sglang · error · ValueError

media_url_max_file_size_mb must be non-negative

Error message

media_url_max_file_size_mb must be non-negative

What it means

configure_media_url_security validates that media_url_max_file_size_mb is >= 0 and rejects negative values. The limit (converted to bytes for the global policy) protects serving workers from unbounded media downloads; a negative limit is meaningless and usually a config arithmetic mistake.

Source

Thrown at python/sglang/srt/utils/common.py:1564

        raise ValueError(f"Invalid allowed media domain {domain!r}") from e
    if not normalized:
        raise ValueError("allowed media domains cannot be empty")
    return normalized


def configure_media_url_security(
    allowed_media_domains: Optional[Sequence[str]] = None,
    max_file_size_mb: int = _DEFAULT_MEDIA_URL_MAX_FILE_SIZE_MB,
) -> list[str]:
    """Configure process-wide safeguards for client-supplied media URLs.

    A serving worker hosts one engine configuration, while media loading fans
    out to worker threads. Keeping the immutable policy here makes the same
    checks apply to image, video, audio, cache, and model-specific loaders.
    """

    if max_file_size_mb < 0:
        raise ValueError("media_url_max_file_size_mb must be non-negative")

    normalized_domains = sorted(
        {_normalize_media_domain(domain) for domain in allowed_media_domains or []}
    )
    global _allowed_media_domains, _media_url_max_file_size_bytes
    _allowed_media_domains = frozenset(normalized_domains)
    _media_url_max_file_size_bytes = max_file_size_mb * 1024 * 1024
    return normalized_domains


def _assert_media_url_allowed(url: str) -> None:
    parsed = urlparse(url)
    if parsed.scheme not in {"http", "https"} or parsed.hostname is None:
        raise ValueError(f"Invalid media URL: {url!r}")

    hostname = _normalize_media_domain(parsed.hostname)
    if _allowed_media_domains and hostname not in _allowed_media_domains:
        raise ValueError(

View on GitHub (pinned to 0132848349)

Solutions

1. Use 0 to disable the size limit instead of a negative value
2. Clamp at config parse time: max(0, int(value))
3. Fix the typo'd number in the config file

Example fix

# before
configure_media_url_security(max_file_size_mb=-1)
# after
configure_media_url_security(max_file_size_mb=0)  # 0 = no limit

max_file_size_mb = max(0, int(raw_value))  # 0 disables the limit
configure_media_url_security(max_file_size_mb=max_file_size_mb)

When it happens

Trigger: Passing max_file_size_mb=-1 (or a negative computed value, e.g. derived from a CLI flag) to configure_media_url_security; hit at scheduler/worker startup via __init__ or _handle_media_url_security, or in tests setUp.

Common situations: CLI parsing that accepts negatives, config files with a typo'd negative number, code that computes 'unlimited = -1' semantics that this API does not support (use 0 to disable).

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• allowed media domains cannot be empty
• allowed media domains must be strings
• Invalid allowed media domain {domain!r}: provide a hostname
• Invalid allowed media domain {domain!r}: ports are not suppo
• Invalid allowed media domain {domain!r}

AI-assisted analysis of sgl-project/sglang@0132848349 (2026-08-28). Data as JSON: /api/errors/f0855a94497f1787. Report an issue: GitHub.