Handle payload-less client_error emits without raising TypeError

Merged
MA
2mo ago
+32-2

Type of change

  • Bug fix (non-breaking change which fixes an issue)

Changes To Core Features:

  • Have you added an explanation of what your changes do and why you'd like us to include them?
  • Have you written new tests for your core changes, as applicable?
  • Have you successfully ran tests with your changes locally?

Defect

FINDING-004 (security-adjacent, medium) from the 0.9.9a1 pre-release testing batch: EventNamespace.on_client_error(self, sid, data) in reflex/app.py gave data no default. python-socketio dispatches events as handler(sid, *data[1:]), so an emit("client_error") with no payload calls on_client_error(sid) and raises TypeError: missing 1 required positional argument: 'data' during parameter binding ā€” before the malformed-payload check, the unknown-SID gate, and the per-SID/per-window rate limiters introduced by #6827 ever run. The exception surfaces via asyncio's "Task exception was never retrieved" handler, so any connected socket ā€” including one that never linked a valid token ā€” could flood the backend logs with tracebacks at default loglevel, unsuppressable via --loglevel, defeating the anti-abuse hardening the handler carries.

Fix

Default data to None. The existing isinstance(data, dict) guard then drops a payload-less emit at debug level exactly like any other malformed payload, so every anti-abuse guard runs first. Docstring updated to explain why the default exists; news fragment news/+client-error-noarg.bugfix.md added.

Test plan

  • New regression test tests/units/test_app.py::test_client_error_no_argument_emit_is_ignored (parametrized over known/unknown SID) simulates socketio's no-argument dispatch by calling on_client_error(sid) with no data, asserting no exception, no report through frontend_exception_handler, and no error/warning log records. It fails on unfixed main with the exact TypeError from the finding and passes with the fix.
  • All 14 client_error tests and the full tests/units/test_app.py (145 tests) pass.
  • uv run ruff check ., uv run ruff format ., and uv run pyright reflex tests (0 errors) are clean.

šŸ¤– Generated with Claude Code

https://claude.ai/code/session_01EMjBXPozsNeQNSBZecNH8x

Generated by Claude Code