Skip to content

Downloads with the same suggested filename silently overwrite each other in the output dir #514

Open
microsoft/playwright
#43930

Description

Downloads are saved to <outputDir>/<suggestedFilename>. Unlike screenshots, snapshots and storage-state files, which get timestamped names, a second download with the same suggested name replaces the first. Both responses report the same path, so the first file is lost without any warning. Sites commonly reuse names such as invoice.pdf, export.csv or report.xlsx.

Steps to reproduce

<!-- dl.html -->
<a href="data:text/plain,v1" download="same.txt">V1</a>
<a href="data:text/plain,v2" download="same.txt">V2</a>
playwright-cli open http://127.0.0.1:8765/dl.html
playwright-cli click 'text=V1'   # Downloaded file same.txt to ".playwright-cli/same.txt"
playwright-cli click 'text=V2'   # Downloaded file same.txt to ".playwright-cli/same.txt"
cat .playwright-cli/same.txt     # v2

Expected

The second download gets a unique name (for example same-1.txt, the way video files get a -1 suffix), and the event reports that path.

Environment

  • @playwright/cli 0.1.23 (main @ f50f579), playwright-core 1.65.0-alpha-2026-10-30
  • Node 22.23.4, Linux x64, Chrome for Testing 153

Activity

  1. github-actions commented on Nov 5, 2026

    @github-actions
  2. microsoft-playwright-automation commented on Nov 5, 2026

    @microsoft-playwright-automation
    Contributor

    Hi, I'm the Playwright bot and I reproduced this on Linux with Chrome at upstream main (1.66.0-next, edeb0bd05176ff187c372c1e38e5d89a232bd5b3).

    Reproduced. The download handler passes the suggested path directly to saveAs(), which overwrites an existing file. The proposed fix reserves a free path before saving and adds -1, -2, etc. before the extension on collision. The completion event reports that path.

    Repro and verification

    The regression test serves two links with download="same.txt" and different contents, then clicks them with playwright-cli click text=V1 and playwright-cli click text=V2. It checks that the events report same.txt and same-1.txt, and that both files retain their respective contents.

    Before the fix, Chrome reports same.txt for both downloads and the test fails. With the fix, the regression passes on Chrome, Chromium, Firefox and WebKit in headless mode on Linux. The CLI save-as and shared file-handling suites pass: 81 passed, 7 existing browser-specific skips. The upstream build and npm run flint also pass.

    Draft PR: microsoft/playwright#43930

    Triaged on Linux by the Playwright bot - agent run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions