[SnowingFox]

Fixes #35862

What

When a connected browser tab sends a frame exceeding the ws default maxPayload (100 MB) — or any otherwise malformed frame — ws emits an error event on that socket (e.g. WS_ERR_UNSUPPORTED_MESSAGE_LENGTH). The server channel transport in code/core/src/core-server/utils/get-server-channel.ts only attaches a message listener inside the connection handler. In Node.js an error event with no listener is fatal, so a single bad frame from one stale/buggy browser tab crashes the entire storybook dev process.

Fix

Attach an error listener on each server-channel socket that logs the error via the already-imported logger and does not rethrow. ws still closes the offending socket itself, so the dev server keeps running.

Test

Added a regression test in server-channel.test.ts that connects a mock socket and emits an error event on it, asserting it does not throw. Without the fix, EventEmitter throws an unhandled error (the exact process-crash behaviour reported); with the fix, the error is handled and the test passes.

Manual testing

1. Start storybook dev and open the preview in a browser.
2. From a connected tab, send an oversized or malformed WebSocket frame (e.g. a message exceeding the ws default maxPayload of 100 MB).
3. Without this fix the storybook dev process crashes on the unhandled socket error; with this fix the error is logged and the dev server keeps running.

Note: this is a one-handler fix verified against the current next source; the full server-channel.test.ts suite will run on CI here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4262b918-9920-42f9-9cee-214836804290

📥 Commits

Reviewing files that changed from the base of the PR and between 9c7afb2 and e0b4846.

📒 Files selected for processing: 2

• code/core/src/core-server/utils/__tests__/server-channel.test.ts
• code/core/src/core-server/utils/get-server-channel.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The server channel now attaches an error listener to each connected WebSocket and logs emitted errors. A regression test checks that emitting a socket error does not throw.

Changes

Server-channel WebSocket error handling

Layer / File(s)	Summary
Per-socket error handling and regression coverage code/core/src/core-server/utils/get-server-channel.ts, code/core/src/core-server/utils/__tests__/server-channel.test.ts	The transport logs errors emitted by connected WebSockets. The test verifies that emitting a socket error does not throw.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to e0b48

The new listener logs malformed-frame errors while the affected connection closes normally. No actionable merge risk remains.

Security architecture risk: 🔵 Low · up to 9c7af

The change is narrowly scoped and improves handling of connection errors without changing authentication, message formats or deployment behavior. No introduced security vulnerability was established, but real malformed-frame handling and failures within logging are not fully verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The relevant availability boundary is the shared development-server process and its connected channel clients. The handler changes error processing within an existing connection; the comparison establishes no new cross-service authority or independently exposed endpoint.

Trust Boundaries and Controls

• observed — Before upgrade, the existing path check, conditional Origin validation and token validation remain in place. The existing skipValidation option still bypasses the latter checks. The new listener is installed after accepted upgrade dispatch and does not alter these admission rules or grant additional privileges.

Resilience and Maintainability Implications

• observed — The warning path has no visible exception boundary and retains log entries until an explicit clear or successful file write. These logging behaviors predate the PR, and upgrade exceptions already reach the same warning path. No attacker-triggerable logging exception or materially worsened logging exposure was established.

Hardening Proposals

• proposed — Consider bounded or sampled protocol-error diagnostics and best-effort logging so diagnostic work cannot undermine connection-level failure containment. This is optional hardening, not an observed vulnerability introduced by the PR.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@code/core/src/core-server/utils/__tests__/server-channel.test.ts`:
- Around line 371-381: Update the test around ServerChannelTransport to release
the transport after asserting the socket error behavior. Emit the transport
socket’s close event during cleanup so the real setInterval started by
ServerChannelTransport is cleared, without adding fake-timer setup.

🪄 Autofix

❌ Autofix failed (check again to retry)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cf4ce7a7-c264-4124-9d80-e55c6a476a4f

📥 Commits

Reviewing files that changed from the base of the PR and between 4b8bfc7 and 512cab7.

📒 Files selected for processing (2)

• code/core/src/core-server/utils/__tests__/server-channel.test.ts
• code/core/src/core-server/utils/get-server-channel.ts

[coderabbitai]

⚠️ Fork-based autofix is unavailable. Re-run autofix from a branch in the upstream repository.