It looks like this doesn't have anything to do with the query builder but instead is a generic query service ui issue. I'm adding the tag for that.
I followed the steps and I can not reproduce the issue (also in Firefox). Can someone else? My hunch is that there is some privacy setting/extension in your browser involved?

Thanks for the reply Lydia! Looks like this issue stems from the Content Security Policy set by the WikiData Query Builder server. I narrowed the issue down to a CSP restriction on the iframe sandbox. It tries to download a resource at blob:https://query.wikidata.org/xxx , but this violates the CSP default-src self; and connect-src 'self' https://www.wikidata.org https://meta.wikimedia.org; directives because the scheme does not match any of the listed sources. (when going directly to the https://query.wikidata.org/embed.html page, I also didn't get this issue, because there is no longer an iframe that tries to download a blob object).

I'm not exactly sure what is necessary to resolve this issue, but I think there are two things to look at first:

• add blob:https://query.wikidata.org to the connect-src directive in the CSP in the http headers (see MDN)
• allow-downloads directive on the iframe sandbox (see MDN)

Note that Google's CSP evaluator already lists a high severity finding for this page ('unsafe-inline' allows the execution of unsafe in-page scripts and event handlers.)

Aha!
Ok then the link to the query is misleading. It's not actually happening in a stand-alone embedded view of the query result. Here is a link that shows the problem: https://w.wiki/5$MM I'll update the task description.

Change 867141 had a related patch set uploaded (by Lucas Werkmeister (WMDE); author: Lucas Werkmeister (WMDE)):

[wikidata/query-builder@master] Add allow-downloads to results iframe sandbox

https://gerrit.wikimedia.org/r/867141

Change 867142 had a related patch set uploaded (by Lucas Werkmeister (WMDE); author: Lucas Werkmeister (WMDE)):

[operations/puppet@production] query_service: support downloads in query builder

https://gerrit.wikimedia.org/r/867142

As far as I can tell, that CSP error is actually limited to Firefox – in Chromium, the <iframe sandbox=""> attribute seems to be the only thing preventing the download. (I didn’t test any other browsers… insert diatribe about Google’s quasi-monopoly on the browser market here /s)

Change 867141 merged by jenkins-bot:

[wikidata/query-builder@master] Add allow-downloads to results iframe sandbox

https://gerrit.wikimedia.org/r/867141

Is this supposed to be fixed in Chrome? I still get the same error:

No, not yet.

Change 867142 merged by Jbond:

[operations/puppet@production] query_service: support downloads in query builder

https://gerrit.wikimedia.org/r/867142

Now it should be working everywhere (I tested Firefox and Chromium).

Works for me now (tested using Chrome, macOS).
Thank you!

Looks good to me too :)

Thanks Lucas!