Skip to content

fix(gui-plugins): download blob built with unsafe type assertion #63479

Closed as not planned

Description

@drpr

Bug

The remote file download helper in packages/gui-plugins/src/file/download.ts builds a Blob from content.bytes as unknown as ArrayBuffer. This double type assertion discards type safety and is unnecessary — Uint8Array is a valid BlobPart.

Fix

Replace new Blob([content.bytes as unknown as ArrayBuffer]) with new Blob([new Uint8Array(content.bytes)]), consistent with the existing word-images.ts pattern.

Activity

  1. opencodejr commented on Nov 12, 2026

    @opencodejr

    Thanks for the report, @drpr.

    I couldn't find the code you describe. packages/gui-plugins/src/file/download.ts isn't on the current main line or in the recent release tags I checked, and I didn't find as unknown as ArrayBuffer anywhere in packages/gui-plugins. The closest code I found is blobUrlFromContent in packages/gui-plugins/src/file/artifact.ts. It already wraps the bytes in a Uint8Array view before creating the Blob: new Blob([view], { type }). That matches the new Blob([new Uint8Array(found.bytes)], ...) pattern you mention from word-images.ts.

    Could you tell us:

    • the branch, commit or release tag where you see download.ts and the as unknown as ArrayBuffer cast
    • whether it causes any visible problem (for example a broken or corrupted download in the desktop app), or whether it's a type-safety cleanup only

    You can reply here with the details, or edit the issue. If you edit it, please also leave a comment saying you've updated it, so we know when you're done.

    I didn't find any existing issues about this.

  2. drpr commented on Nov 12, 2026

    @drpr
    Author

    Closing — the description was incorrect. This issue described a type-safety fix, but the actual PR #63472 adds a file download feature for remote connections. Opening a new issue with the correct description.

  3. opencodejr commented on Nov 12, 2026

    @opencodejr

    Hi @drpr, we haven't heard back, so I'm closing this issue as not planned.

    We were waiting to hear which branch, commit or release tag has packages/gui-plugins/src/file/download.ts and the as unknown as ArrayBuffer cast. I couldn't find that file or that pattern in the current code, so there's nothing for us to change without that detail.

    If you can still point us to the code, or if it causes a visible problem such as a broken download in the desktop app, reply here with the details and the issue will reopen.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions