@marimo-team/islands 0.25.3-dev234 → 0.25.3-dev237

package/dist/{number-overlay-editor-CLebwF9p.js → number-overlay-editor-Cs7p1xEn.js}

@@ -1,6 +1,6 @@
 import { a as e } from "./rolldown-runtime-Cb76FRpK.js";
 import { t } from "./react-sHtZdjeP.js";
-import { a as n } from "./glide-data-editor-C4mQ2b_i.js";
+import { a as n } from "./glide-data-editor-C9q9eMDX.js";
 //#region ../node_modules/.pnpm/@glideapps+glide-data-grid@6.0.4-alpha24_lodash@4.17.21_marked@15.0.12_react-dom@19.3.0_27cffe7f1bc30287d59ac27db3240c5b/node_modules/@glideapps/glide-data-grid/dist/esm/internal/data-grid-overlay-editor/private/number-overlay-editor-style.js
 var r = /* @__PURE__ */ e(t()), i = /*#__PURE__*/ n("div")({
 	name: "NumberOverlayEditorStyle",

package/dist/{reveal-component-CMsZlXqO.js → reveal-component-fa3zmIpy.js}

@@ -3,7 +3,7 @@ import { c as t, g as n, h as r, m as i, t as a } from "./button-B6RjDKJx.js";
 import { t as o } from "./react-sHtZdjeP.js";
 import { t as s } from "./compiler-runtime-CldRdSsv.js";
 import { m as c, t as l } from "./tooltip-C3UnvsRe.js";
-import { $ as u, Q as d, Z as f, an as p, i as m, l as h, ln as g, n as _, on as v, r as y, t as b, u as x } from "./common-jgy6-GsH.js";
+import { $ as u, Q as d, et as f, i as p, l as m, n as h, on as g, r as _, sn as v, t as y, u as b, un as x } from "./common-Di0CUoCv.js";
 import { M as S } from "./select-BSxlITBo.js";
 import { Y as ee } from "./dropdown-menu-BRiE7Vnp.js";
 import { Pt as C } from "./error-entries-CRPfxMqm.js";
@@ -11,7 +11,7 @@ import { t as w } from "./jsx-runtime-3BD1kT0s.js";
 import { r as T } from "./use-restore-focus-BWO0z1lo.js";
 import { D as E, t as D, x as O } from "./utils-DXkj82sK.js";
 import { o as k } from "./static-state-BldGd99T.js";
-import { a as A, n as te, t as ne } from "./code-visibility-D5qD3Vpw.js";
+import { a as A, n as te, t as ne } from "./code-visibility-Bf42Zr3d.js";
 /* empty css                */
 var j = c("sticky-note", [["path", {
 	d: "M21 9a2.4 2.4 0 0 0-.706-1.706l-3.588-3.588A2.4 2.4 0 0 0 15 3H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2z",
@@ -6493,11 +6493,11 @@ function aa(e) {
 }
 var oa = (e) => {
 	let t = (0, N.c)(13), { cell: n } = e, r;
-	t[0] !== n.id || t[1] !== n.name ? (r = b(n.id, n.name), t[0] = n.id, t[1] = n.name, t[2] = r) : r = t[2];
+	t[0] !== n.id || t[1] !== n.name ? (r = y(n.id, n.name), t[0] = n.id, t[1] = n.name, t[2] = r) : r = t[2];
 	let i = n.id, a = n.status, o = n.output, s;
 	t[3] === n ? s = t[4] : (s = C(n, !1), t[3] = n, t[4] = s);
 	let c;
-	t[5] !== n.id || t[6] !== n.output || t[7] !== n.status || t[8] !== s ? (c = /* @__PURE__ */ (0, G.jsx)(x, {
+	t[5] !== n.id || t[6] !== n.output || t[7] !== n.status || t[8] !== s ? (c = /* @__PURE__ */ (0, G.jsx)(b, {
 		cellId: i,
 		status: a,
 		output: o,
@@ -6557,7 +6557,7 @@ var la = (e) => {
 	let o;
 	return t[3] === n ? o = t[4] : (o = /* @__PURE__ */ (0, G.jsx)(oa, { cell: n }), t[3] = n, t[4] = o), o;
 }, ua = (e) => {
-	let n = (0, N.c)(164), { slideCells: o, layout: s, setLayout: c, noOutputIds: b, activeIndex: x, onSlideChange: S, mode: ee, configWidth: C, isEditable: w } = e, j = w !== void 0 && w, re = (0, M.useRef)(null), P = (0, M.useRef)(null), { width: ie, height: ae } = $i(re), F = T() != null, [I, L] = (0, M.useState)(1), oe;
+	let n = (0, N.c)(164), { slideCells: o, layout: s, setLayout: c, noOutputIds: y, activeIndex: b, onSlideChange: S, mode: ee, configWidth: C, isEditable: w } = e, j = w !== void 0 && w, re = (0, M.useRef)(null), P = (0, M.useRef)(null), { width: ie, height: ae } = $i(re), F = T() != null, [I, L] = (0, M.useState)(1), oe;
 	n[0] === Symbol.for("react.memo_cache_sentinel") ? (oe = () => {
 		let e = requestAnimationFrame(() => {
 			let e = P.current;
@@ -6572,19 +6572,19 @@ var la = (e) => {
 		F
 	], n[1] = ae, n[2] = F, n[3] = ie, n[4] = se) : se = n[4], (0, M.useEffect)(oe, se);
 	let R = O(k), ce = O(te).kind, le = O(A), ue = ce !== "wasm" || le, de;
-	n[5] !== R || n[6] !== ce ? (de = R || !m(ce) ? [] : [Ui], n[5] = R, n[6] = ce, n[7] = de) : de = n[7];
+	n[5] !== R || n[6] !== ce ? (de = R || !p(ce) ? [] : [Ui], n[5] = R, n[6] = ce, n[7] = de) : de = n[7];
 	let fe = de, [pe, me] = (0, M.useState)(da), he = ne(), ge;
 	n[8] === he ? ge = n[9] : (ge = !D() && he, n[8] = he, n[9] = ge);
 	let _e = ge, ve;
-	n[10] === R ? ve = n[11] : (ve = y(R, window.location.search), n[10] = R, n[11] = ve);
-	let z = !ve && _e, ye = x == null ? void 0 : o[x], be;
+	n[10] === R ? ve = n[11] : (ve = _(R, window.location.search), n[10] = R, n[11] = ve);
+	let z = !ve && _e, ye = b == null ? void 0 : o[b], be;
 	n[12] !== ye || n[13] !== o ? (be = ye ?? o.at(0), n[12] = ye, n[13] = o, n[14] = be) : be = n[14];
 	let xe = be, Se;
-	n[15] !== ye || n[16] !== s.cells || n[17] !== b ? (Se = {
+	n[15] !== ye || n[16] !== s.cells || n[17] !== y ? (Se = {
 		activeCell: ye,
 		slideConfigs: s.cells,
-		noOutputIds: b
-	}, n[15] = ye, n[16] = s.cells, n[17] = b, n[18] = Se) : Se = n[18];
+		noOutputIds: y
+	}, n[15] = ye, n[16] = s.cells, n[17] = y, n[18] = Se) : Se = n[18];
 	let { parkedPreviewCell: B, isHeldEdit: Ce, isNoOutputPreview: we, heldEditCellId: Te, heldShowsCode: Ee, toggleHeldShowsCode: De } = ra(Se), Oe;
 	n[19] !== _e || n[20] !== s.cells || n[21] !== pe ? (Oe = (e) => ta({
 		cells: s.cells,
@@ -6597,12 +6597,12 @@ var la = (e) => {
 	let je = Ae, Me;
 	n[28] !== V || n[29] !== _e || n[30] !== s.cells ? (Me = _e && V != null && (s.cells.get(V)?.showCode ?? !1), n[28] = V, n[29] = _e, n[30] = s.cells, n[31] = Me) : Me = n[31];
 	let Ne = Me, Pe;
-	n[32] !== Te || n[33] !== s.cells || n[34] !== b ? (Pe = (e) => na({
+	n[32] !== Te || n[33] !== s.cells || n[34] !== y ? (Pe = (e) => na({
 		cell: e,
-		noOutputIds: b,
+		noOutputIds: y,
 		heldEditCellId: Te,
 		slideConfigs: s.cells
-	}), n[32] = Te, n[33] = s.cells, n[34] = b, n[35] = Pe) : Pe = n[35];
+	}), n[32] = Te, n[33] = s.cells, n[34] = y, n[35] = Pe) : Pe = n[35];
 	let Fe;
 	n[36] !== o || n[37] !== Pe ? (Fe = nr({
 		cells: o,
@@ -6617,7 +6617,7 @@ var la = (e) => {
 	let { cellToTarget: Re, targetToCellIndex: ze } = Le, Be = s.deck?.transition ?? "slide", Ve = s.deck?.verticalAlign, H;
 	n[42] === Ve ? H = n[43] : (H = aa(Ve), n[42] = Ve, n[43] = H);
 	let U = H, He;
-	n[44] === Symbol.for("react.memo_cache_sentinel") ? (He = _(window.location.href), n[44] = He) : He = n[44];
+	n[44] === Symbol.for("react.memo_cache_sentinel") ? (He = h(window.location.href), n[44] = He) : He = n[44];
 	let Ue = He, We;
 	n[45] === Be ? We = n[46] : (We = {
 		embedded: !0,
@@ -6632,33 +6632,33 @@ var la = (e) => {
 		scrollActivationWidth: 0
 	}, n[45] = Be, n[46] = We);
 	let Ge = We, Ke;
-	n[47] !== x || n[48] !== ue || n[49] !== Re || n[50] !== o ? (Ke = (e) => {
-		if (x == null && window.location.hash.startsWith("#/")) {
+	n[47] !== b || n[48] !== ue || n[49] !== Re || n[50] !== o ? (Ke = (e) => {
+		if (b == null && window.location.hash.startsWith("#/")) {
 			if (!ue) return;
 			window.dispatchEvent(new HashChangeEvent("hashchange")), Yi(e);
 			return;
 		}
 		let t = or({
-			activeIndex: x,
+			activeIndex: b,
 			cells: o,
 			cellToTarget: Re,
 			getId: ma
 		}), n = t && sr(e.getIndices(), t);
 		n && (e.slide(n.h, n.v, n.f), Yi(e));
-	}, n[47] = x, n[48] = ue, n[49] = Re, n[50] = o, n[51] = Ke) : Ke = n[51];
+	}, n[47] = b, n[48] = ue, n[49] = Re, n[50] = o, n[51] = Ke) : Ke = n[51];
 	let qe = E(Ke), Je;
 	n[52] === qe ? Je = n[53] : (Je = () => {
 		let e = P.current;
 		e != null && qe(e);
 	}, n[52] = qe, n[53] = Je);
 	let Ye;
-	n[54] !== x || n[55] !== ue || n[56] !== Re || n[57] !== qe || n[58] !== o ? (Ye = [
-		x,
+	n[54] !== b || n[55] !== ue || n[56] !== Re || n[57] !== qe || n[58] !== o ? (Ye = [
+		b,
 		ue,
 		Re,
 		o,
 		qe
-	], n[54] = x, n[55] = ue, n[56] = Re, n[57] = qe, n[58] = o, n[59] = Ye) : Ye = n[59], (0, M.useEffect)(Je, Ye);
+	], n[54] = b, n[55] = ue, n[56] = Re, n[57] = qe, n[58] = o, n[59] = Ye) : Ye = n[59], (0, M.useEffect)(Je, Ye);
 	let Xe;
 	n[60] !== V || n[61] !== Ne || n[62] !== Ce || n[63] !== De ? (Xe = () => {
 		if (!(V == null || Ne)) {
@@ -6705,14 +6705,14 @@ var la = (e) => {
 		t instanceof HTMLElement && (t.tabIndex = -1, t.focus({ preventScroll: !0 }));
 	}, n[75] = ue, n[76] = z, n[77] = qe, n[78] = tt, n[79] = Ze, n[80] = it) : it = n[80];
 	let at = E(it), W;
-	n[81] !== x || n[82] !== S || n[83] !== B || n[84] !== o ? (W = (e) => {
-		if (!B || x == null || i.fromInput(e)) return;
+	n[81] !== b || n[82] !== S || n[83] !== B || n[84] !== o ? (W = (e) => {
+		if (!B || b == null || i.fromInput(e)) return;
 		let t = Qi(e);
 		if (t === 0) return;
 		e.preventDefault(), e.stopPropagation();
-		let n = x + t;
+		let n = b + t;
 		n < 0 || n >= o.length || S?.(n);
-	}, n[81] = x, n[82] = S, n[83] = B, n[84] = o, n[85] = W) : W = n[85];
+	}, n[81] = b, n[82] = S, n[83] = B, n[84] = o, n[85] = W) : W = n[85];
 	let ot = E(W), st;
 	n[86] === rt ? st = n[87] : (st = () => {
 		rt();
@@ -6767,7 +6767,7 @@ var la = (e) => {
 		"aria-label": ut ?? void 0,
 		children: [ut && /* @__PURE__ */ (0, G.jsxs)("div", {
 			className: "flex items-center gap-1.5 px-3 py-1.5 text-xs text-muted-foreground border-b bg-muted/40",
-			children: [/* @__PURE__ */ (0, G.jsx)(p, { className: "h-3.5 w-3.5" }), /* @__PURE__ */ (0, G.jsx)("span", { children: ut })]
+			children: [/* @__PURE__ */ (0, G.jsx)(g, { className: "h-3.5 w-3.5" }), /* @__PURE__ */ (0, G.jsx)("span", { children: ut })]
 		}), /* @__PURE__ */ (0, G.jsx)("div", {
 			className: "reveal mo-slides-theme prose-slides absolute left-1/2 top-1/2",
 			"data-testid": "slide-preview-canvas",
@@ -6801,7 +6801,7 @@ var la = (e) => {
 			"aria-disabled": Ne,
 			"aria-label": Ne ? "Code always shown" : je ? "Hide code" : "Show code",
 			onClick: Ze,
-			children: /* @__PURE__ */ (0, G.jsx)(g, { className: "h-4 w-4" })
+			children: /* @__PURE__ */ (0, G.jsx)(x, { className: "h-4 w-4" })
 		})
 	}), n[128] = je, n[129] = Ne, n[130] = z, n[131] = Ze, n[132] = q) : q = n[132];
 	let bt;
@@ -6847,7 +6847,7 @@ var la = (e) => {
 		}), n[141] = St, n[142] = e), e;
 	}
 	let Y;
-	n[143] === St ? Y = n[144] : (Y = /* @__PURE__ */ (0, G.jsx)(f, {
+	n[143] === St ? Y = n[144] : (Y = /* @__PURE__ */ (0, G.jsx)(d, {
 		defaultSize: 92,
 		minSize: 60,
 		children: St
@@ -6858,13 +6858,13 @@ var la = (e) => {
 		fine: 4
 	}, n[145] = Ct) : Ct = n[145];
 	let wt;
-	n[146] === F ? wt = n[147] : (wt = /* @__PURE__ */ (0, G.jsx)(u, {
+	n[146] === F ? wt = n[147] : (wt = /* @__PURE__ */ (0, G.jsx)(f, {
 		className: "mo-slides-notes-resize",
 		hitAreaMargins: Ct,
 		disabled: F
 	}), n[146] = F, n[147] = wt);
 	let Tt = xe?.id, Et;
-	n[148] !== s || n[149] !== c || n[150] !== Tt ? (Et = /* @__PURE__ */ (0, G.jsx)(f, {
+	n[148] !== s || n[149] !== c || n[150] !== Tt ? (Et = /* @__PURE__ */ (0, G.jsx)(d, {
 		defaultSize: 10,
 		minSize: 4,
 		collapsible: !0,
@@ -6876,7 +6876,7 @@ var la = (e) => {
 		})
 	}), n[148] = s, n[149] = c, n[150] = Tt, n[151] = Et) : Et = n[151];
 	let Dt;
-	n[152] !== Y || n[153] !== wt || n[154] !== Et ? (Dt = /* @__PURE__ */ (0, G.jsxs)(d, {
+	n[152] !== Y || n[153] !== wt || n[154] !== Et ? (Dt = /* @__PURE__ */ (0, G.jsxs)(u, {
 		direction: "vertical",
 		autoSaveId: "marimo:slides:notes-panel",
 		className: "flex-1 min-w-0",
@@ -6887,7 +6887,7 @@ var la = (e) => {
 		]
 	}), n[152] = Y, n[153] = wt, n[154] = Et, n[155] = Dt) : Dt = n[155];
 	let Ot;
-	n[156] !== xe || n[157] !== C || n[158] !== s || n[159] !== c ? (Ot = /* @__PURE__ */ (0, G.jsx)(h, {
+	n[156] !== xe || n[157] !== C || n[158] !== s || n[159] !== c ? (Ot = /* @__PURE__ */ (0, G.jsx)(m, {
 		configWidth: C,
 		layout: s,
 		setLayout: c,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marimo-team/islands",
-  "version": "0.25.3-dev234",
+  "version": "0.25.3-dev237",
   "main": "dist/main.js",
   "types": "dist/index.d.ts",
   "type": "module",

package/src/plugins/layout/DownloadPlugin.tsx

@@ -6,7 +6,7 @@ import { z } from "zod";
 import { buttonVariants } from "@/components/ui/button";
 import { toast } from "@/components/ui/use-toast";
 import { cn } from "@/utils/cn";
-import { downloadByURL } from "@/utils/download";
+import { downloadByURL, isDownloadUrl } from "@/utils/download";
 import { Logger } from "@/utils/Logger";
 import { createPlugin } from "../core/builder";
 import { renderHTML } from "../core/RenderHTML";
@@ -80,7 +80,7 @@ const DownloadButton = ({
   const [isLoading, setIsLoading] = useState(false);
 
   const handleClick = async (e: React.MouseEvent) => {
-    if (data.disabled) {
+    if (data.disabled || isLoading) {
       e.preventDefault();
       e.stopPropagation();
       return;
@@ -88,15 +88,11 @@ const DownloadButton = ({
 
     e.preventDefault();
 
-    if (!data.lazy) {
-      downloadByURL(data.data, data.filename ?? undefined);
-      return;
-    }
-
-    setIsLoading(true);
-
     try {
-      const loadedData = await load({});
+      if (data.lazy) {
+        setIsLoading(true);
+      }
+      const loadedData = data.lazy ? await load({}) : data;
       downloadByURL(
         loadedData.data || data.data,
         loadedData.filename ?? data.filename ?? undefined,
@@ -117,7 +113,7 @@ const DownloadButton = ({
 
   return (
     <a
-      href={data.data}
+      href={isDownloadUrl(data.data) ? data.data : undefined}
       download={data.filename ?? ""}
       onClick={handleClick}
       className={buttonVariants({

package/src/plugins/layout/__test__/DownloadPlugin.test.tsx

@@ -0,0 +1,196 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+
+import {
+  act,
+  cleanup,
+  fireEvent,
+  render,
+  waitFor,
+} from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { Mocks } from "@/__mocks__/common";
+import { toast } from "@/components/ui/use-toast";
+import { assertExists } from "@/utils/assertExists";
+import { Deferred } from "@/utils/Deferred";
+import { registerReactComponent } from "../../core/registerReactComponent";
+import { sanitizeHtml } from "../../core/sanitize-html";
+import { DownloadPlugin } from "../DownloadPlugin";
+
+vi.mock("@/components/ui/use-toast", () => ({ toast: vi.fn() }));
+vi.mock("@/utils/Logger", () => ({ Logger: Mocks.quietLogger() }));
+
+type DownloadData = Parameters<typeof DownloadPlugin.render>[0]["data"];
+type Load = Parameters<typeof DownloadPlugin.render>[0]["functions"]["load"];
+
+function renderDownload(
+  data: Partial<DownloadData> = {},
+  load = vi.fn<Load>(),
+) {
+  const result = render(
+    DownloadPlugin.render({
+      host: document.createElement("div"),
+      value: null,
+      setValue: vi.fn(),
+      data: DownloadPlugin.validator.parse({
+        data: "./@file/123-results.csv",
+        filename: "results.csv",
+        ...data,
+      }),
+      functions: { load },
+    }),
+  );
+  const button = result.getByText("Download").closest("a");
+  assertExists(button);
+  return { ...result, load, button };
+}
+
+describe("DownloadPlugin", () => {
+  const downloads: { href: string | null; filename: string | null }[] = [];
+
+  beforeEach(() => {
+    downloads.length = 0;
+    vi.spyOn(HTMLAnchorElement.prototype, "click").mockImplementation(function (
+      this: HTMLAnchorElement,
+    ) {
+      downloads.push({
+        href: this.getAttribute("href"),
+        filename: this.getAttribute("download"),
+      });
+    });
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.restoreAllMocks();
+    vi.clearAllMocks();
+  });
+
+  it("downloads immediately without calling load", () => {
+    const { button, load } = renderDownload();
+    fireEvent.click(button);
+
+    expect(downloads).toEqual([
+      { href: "./@file/123-results.csv", filename: "results.csv" },
+    ]);
+    expect(load).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    { data: "data:text/plain,hello", filename: "loaded.txt" },
+    { data: "", filename: "renamed.csv" },
+    { data: "data:text/plain,hello", filename: null },
+  ])("downloads lazy data with metadata fallbacks: %j", async (loadedData) => {
+    const load = vi.fn<Load>().mockResolvedValue(loadedData);
+    const { button } = renderDownload({ lazy: true }, load);
+    fireEvent.click(button);
+
+    await waitFor(() => {
+      expect(downloads).toEqual([
+        {
+          href: loadedData.data || "./@file/123-results.csv",
+          filename: loadedData.filename ?? "results.csv",
+        },
+      ]);
+    });
+    expect(load).toHaveBeenCalledExactlyOnceWith({});
+  });
+
+  it.each([false, true])("ignores disabled clicks (lazy=%s)", (lazy) => {
+    const { button, load } = renderDownload({ disabled: true, lazy });
+    fireEvent.click(button);
+    expect(downloads).toEqual([]);
+    expect(load).not.toHaveBeenCalled();
+    expect(toast).not.toHaveBeenCalled();
+  });
+
+  it.each([false, true])(
+    "handles an unsupported URL (lazy=%s)",
+    async (lazy) => {
+      const data = "java\nscript:alert(1)";
+      const load = vi.fn<Load>().mockResolvedValue({ data });
+      const { button } = renderDownload({ data, lazy }, load);
+      expect(button.hasAttribute("href")).toBe(false);
+      fireEvent.click(button);
+
+      await waitFor(() => {
+        expect(toast).toHaveBeenCalledWith({
+          title: "Failed to download",
+          description: "Please try again.",
+        });
+      });
+      expect(downloads).toEqual([]);
+    },
+  );
+
+  it("validates the lazy response even when the initial URL is valid", async () => {
+    const load = vi
+      .fn<Load>()
+      .mockResolvedValue({ data: "javascript:alert(1)" });
+    const { button } = renderDownload({ lazy: true }, load);
+    fireEvent.click(button);
+
+    await waitFor(() => expect(toast).toHaveBeenCalledOnce());
+    expect(downloads).toEqual([]);
+  });
+
+  it("validates the fallback URL when lazy loading only returns a filename", async () => {
+    const load = vi
+      .fn<Load>()
+      .mockResolvedValue({ data: "", filename: "file.txt" });
+    const { button } = renderDownload(
+      { data: "javascript:alert(1)", lazy: true },
+      load,
+    );
+    fireEvent.click(button);
+
+    await waitFor(() => expect(toast).toHaveBeenCalledOnce());
+    expect(downloads).toEqual([]);
+  });
+
+  it("ignores clicks while loading and allows retry after a failed load", async () => {
+    const pendingLoad = new Deferred<Awaited<ReturnType<Load>>>();
+    const load = vi
+      .fn<Load>()
+      .mockReturnValueOnce(pendingLoad.promise)
+      .mockResolvedValue({ data: "data:text/plain,retry" });
+    const { button } = renderDownload({ data: "", lazy: true }, load);
+    fireEvent.click(button);
+    fireEvent.click(button);
+    expect(load).toHaveBeenCalledOnce();
+
+    await act(async () => pendingLoad.reject(new Error("Load failed")));
+    expect(toast).toHaveBeenCalledOnce();
+    expect(downloads).toEqual([]);
+
+    fireEvent.click(button);
+    await waitFor(() =>
+      expect(downloads).toEqual([
+        { href: "data:text/plain,retry", filename: "results.csv" },
+      ]),
+    );
+    expect(load).toHaveBeenCalledTimes(2);
+  });
+
+  it("rejects an unsupported URL restored from sanitized output", async () => {
+    registerReactComponent(DownloadPlugin);
+    const container = document.createElement("div");
+    container.innerHTML = sanitizeHtml(
+      `<marimo-download data-data='"javascript:alert(1)"' data-initial-value='null' data-disabled='false' data-lazy='false'></marimo-download>`,
+    );
+    try {
+      await act(async () => {
+        document.body.append(container);
+      });
+      const button = container
+        .querySelector("marimo-download")
+        ?.shadowRoot?.querySelector("a");
+      assertExists(button);
+      expect(button.hasAttribute("href")).toBe(false);
+      fireEvent.click(button);
+      expect(toast).toHaveBeenCalledOnce();
+      expect(downloads).toEqual([]);
+    } finally {
+      await act(async () => container.remove());
+    }
+  });
+});

package/src/utils/__tests__/download.test.tsx

@@ -595,24 +595,77 @@ describe("downloadByURL", () => {
   });
 
   it("should create anchor, set attributes, click, and remove", () => {
-    downloadByURL("data:test", "filename.png");
+    downloadByURL("data:image/png;base64,AAA=", "filename.png");
 
     expect(document.createElement).toHaveBeenCalledWith("a");
-    expect(mockAnchor.href).toBe("data:test");
+    expect(mockAnchor.href).toBe("data:image/png;base64,AAA=");
     expect(mockAnchor.download).toBe("filename.png");
     expect(mockAnchor.click).toHaveBeenCalled();
     expect(mockAnchor.remove).toHaveBeenCalled();
   });
 
+  it.each([
+    "https://example.com/results.csv",
+    "http://example.com/results.csv",
+    "//example.com/results.csv",
+    "./@file/123-results.csv",
+    "/files/results.csv?download=1#data",
+    "../results.csv",
+    "blob:http://localhost/123",
+    "data:text/csv;charset=utf-8,a%2Cb",
+    "DATA:TEXT/PLAIN;base64,aGVsbG8=",
+    "data:application/json,%7B%7D",
+    "data:application/octet-stream;base64,AAA=",
+    "data:,hello",
+    "data:;base64,aGVsbG8=",
+    "data:text/plain,",
+    " https://example.com/results.csv ",
+  ])("downloads %s without an explicit filename", (url) => {
+    downloadByURL(url);
+
+    expect(mockAnchor.getAttribute("href")).toBe(url);
+    expect(mockAnchor.getAttribute("download")).toBe("");
+    expect(mockAnchor.click).toHaveBeenCalledOnce();
+  });
+
+  it.each([
+    "javascript:alert(1)",
+    "JaVaScRiPt:alert(1)",
+    " \u0000javascript:alert(1)",
+    "java\tscript:alert(1)",
+    "java\nscript:alert(1)",
+    "java\rscript:alert(1)",
+    "vbscript:msgbox(1)",
+    "file:///tmp/results.csv",
+    "ftp://example.com/results.csv",
+    "mailto:example@example.com",
+    "data:text/html,<h1>hello</h1>",
+    "data:TEXT/HTML;charset=utf-8;base64,AAA=",
+    "data:image/svg+xml,<svg/>",
+    "data:application/xhtml+xml,<html/>",
+    "data:text/javascript,alert(1)",
+    "data:text/plain",
+    "https://[invalid",
+    "",
+    " \n\t",
+  ])("rejects %j before creating a download link", (url) => {
+    expect(() => downloadByURL(url)).toThrow("Unsupported download URL");
+    expect(document.createElement).not.toHaveBeenCalled();
+    expect(mockAnchor.click).not.toHaveBeenCalled();
+  });
+
   it("downloads an exported file with its returned metadata", async () => {
     let downloadedBlob: Blob | undefined;
-    vi.stubGlobal("URL", {
-      createObjectURL: vi.fn((blob: Blob) => {
-        downloadedBlob = blob;
-        return "blob:export";
-      }),
-      revokeObjectURL: vi.fn(),
-    });
+    vi.stubGlobal(
+      "URL",
+      class extends URL {
+        public static override createObjectURL = vi.fn((blob: Blob) => {
+          downloadedBlob = blob;
+          return "blob:export";
+        });
+        public static override revokeObjectURL = vi.fn();
+      },
+    );
 
     downloadExportedFile({
       contents: "notebook",

package/src/utils/download.ts

@@ -12,6 +12,7 @@ import { captureExternalIframes } from "./iframe";
 import { Logger } from "./Logger";
 import { ProgressState } from "./progress";
 import { ToastProgress } from "./toast-progress";
+import { asURL } from "./url";
 
 const FINISH_TOAST_DURATION_MS = 1200;
 type ToastConfig = Omit<Parameters<typeof toast>[0], "id">;
@@ -177,12 +178,63 @@ export async function downloadHTMLAsImage(opts: {
   }
 }
 
+const DOWNLOAD_DATA_TYPES = new Set([
+  "text/plain",
+  "text/csv",
+  "text/tab-separated-values",
+  "application/json",
+  "application/octet-stream",
+  "application/pdf",
+  "application/zip",
+  "application/gzip",
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "image/avif",
+  "image/bmp",
+  "image/x-icon",
+]);
+
+export function isDownloadUrl(url: string): boolean {
+  if (!url.trim()) {
+    return false;
+  }
+  try {
+    const parsed = asURL(url);
+    switch (parsed.protocol) {
+      case "http:":
+      case "https:":
+      case "blob:":
+        return true;
+      case "data:": {
+        const comma = parsed.pathname.indexOf(",");
+        if (comma === -1) {
+          return false;
+        }
+        const mimeType = parsed.pathname
+          .slice(0, comma)
+          .split(";", 1)[0]
+          .trim()
+          .toLowerCase();
+        // An omitted MIME type defaults to text/plain.
+        return DOWNLOAD_DATA_TYPES.has(mimeType || "text/plain");
+      }
+      default:
+        return false;
+    }
+  } catch {
+    return false;
+  }
+}
+
 export function downloadByURL(url: string, filename?: string) {
+  if (!isDownloadUrl(url)) {
+    throw new Error("Unsupported download URL");
+  }
   const a = document.createElement("a");
   a.href = url;
-  if (filename) {
-    a.download = filename;
-  }
+  a.download = filename ?? "";
   a.click();
   a.remove();
 }