Handle payload-less client_error emits without raising TypeError

[masenf]

Type of change

• Bug fix (non-breaking change which fixes an issue)

Changes To Core Features:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your core changes, as applicable?
• Have you successfully ran tests with your changes locally?

Defect

FINDING-004 (security-adjacent, medium) from the 0.9.9a1 pre-release testing batch: EventNamespace.on_client_error(self, sid, data) in reflex/app.py gave data no default. python-socketio dispatches events as handler(sid, *data[1:]), so an emit("client_error") with no payload calls on_client_error(sid) and raises TypeError: missing 1 required positional argument: 'data' during parameter binding — before the malformed-payload check, the unknown-SID gate, and the per-SID/per-window rate limiters introduced by #6827 ever run. The exception surfaces via asyncio's "Task exception was never retrieved" handler, so any connected socket — including one that never linked a valid token — could flood the backend logs with tracebacks at default loglevel, unsuppressable via --loglevel, defeating the anti-abuse hardening the handler carries.

Fix

Default data to None. The existing isinstance(data, dict) guard then drops a payload-less emit at debug level exactly like any other malformed payload, so every anti-abuse guard runs first. Docstring updated to explain why the default exists; news fragment news/+client-error-noarg.bugfix.md added.

Test plan

• New regression test tests/units/test_app.py::test_client_error_no_argument_emit_is_ignored (parametrized over known/unknown SID) simulates socketio's no-argument dispatch by calling on_client_error(sid) with no data, asserting no exception, no report through frontend_exception_handler, and no error/warning log records. It fails on unfixed main with the exact TypeError from the finding and passes with the fix.
• All 14 client_error tests and the full tests/units/test_app.py (145 tests) pass.
• uv run ruff check ., uv run ruff format ., and uv run pyright reflex tests (0 errors) are clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EMjBXPozsNeQNSBZecNH8x

---

Generated by Claude Code

[greptile-apps]

Greptile Summary

The PR makes EventNamespace.on_client_error accept payload-less Socket.IO events and routes the missing payload through the existing malformed-payload guard.

• Defaults the optional client-error payload to None.
• Documents why payload-less dispatch requires the default.
• Adds regression coverage for known and unknown session IDs.
• Adds a bug-fix news fragment.

Confidence Score: 5/5

The PR appears safe to merge because payload-less client-error events now reach the existing malformed-input guard without changing valid-payload handling.

The signature-only behavioral change converts an omitted argument into None, and the existing first guard returns immediately for that value; focused regression tests cover both known and unknown session IDs.

Important Files Changed

Filename	Overview
reflex/app.py	Safely defaults the client-error payload to None, which the existing dictionary guard immediately rejects without triggering reporting.
tests/units/test_app.py	Adds focused regression coverage confirming payload-less calls neither raise nor produce frontend reports or warning/error console output.
news/+client-error-noarg.bugfix.md	Accurately documents the payload-less dispatch failure and the resulting behavior.

_{Reviews (1): Last reviewed commit: "Default client_error payload to None so ..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 27 untouched benchmarks
⏩ 8 skipped benchmarks¹

---

_{Comparing claude/rel-fix-client-error-noarg (5cc3029) with main (f7c848f)²}

Footnotes

1. 8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on main (45b8ed5) during the generation of this report, so f7c848f was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}