From 78f379313603779eded71639e08d0d8e4bc37282 Mon Sep 17 00:00:00 2001 From: angaduom Date: Wed, 18 Feb 2026 11:20:58 -0500 Subject: [PATCH] Add .cve-fix/examples.md with real CVE fix patterns - Document 5 real CVE fixes from repository history - Include good fix and bad fix examples for each CVE - Add common patterns, testing checklist, and repository-specific rules - Based on actual commits: path-to-regexp, form-data, cross-spawn, word-wrap, nanoid This file provides guidance for the CVE fixer workflow to ensure consistent, successful fixes following proven patterns. Co-Authored-By: Claude Sonnet 4.5 --- .cve-fix/examples.md | 361 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 361 insertions(+) create mode 100644 .cve-fix/examples.md diff --git a/.cve-fix/examples.md b/.cve-fix/examples.md new file mode 100644 index 00000000000..333ac75de2e --- /dev/null +++ b/.cve-fix/examples.md @@ -0,0 +1,361 @@ +# CVE Fix Examples for ODH Dashboard + +This file contains real examples of CVE fixes applied to the ODH Dashboard repository. These patterns serve as guidance for the CVE fixer workflow to ensure consistent, successful fixes. + +--- + +## CVE-2024-52798 - path-to-regexp ReDoS Vulnerability + +**Context:** Unpatched Regular Expression Denial of Service (ReDoS) in path-to-regexp 0.1.x used by Express.js + +### Good Fix ✅ + +**Commit:** 20bb26b9076eb1e8ff7f58c4f65200c51383ccfd +**What worked well:** +- Upgraded Express from 4.21.1 to 4.21.2, which includes path-to-regexp 0.1.12 +- The fix was applied via Express's dependency tree (transitive dependency) +- Only frontend/package-lock.json needed updating +- No direct dependency changes required in package.json +- Simple lock file update resolved the vulnerability + +**Key actions:** +```bash +# The fix came through Express upgrade +npm update express # Updates to 4.21.2 +# Express 4.21.2 → includes path-to-regexp 0.1.12 (fixed) +``` + +**Files changed:** +- `frontend/package-lock.json` (express version + path-to-regexp nested dependency) + +**Important considerations:** +- path-to-regexp is a transitive dependency of Express +- Don't try to override path-to-regexp directly when it's deeply nested +- Express upgrade is the correct approach for this CVE +- Version 0.1.12 is a security patch with no breaking changes + +### Bad Fix ❌ + +**What to avoid:** +- Adding direct npm override for path-to-regexp when it's an Express dependency +- Trying to upgrade path-to-regexp without upgrading Express +- Forgetting to update package-lock.json after dependency changes + +**Why it didn't work:** +- npm overrides can create version conflicts with Express's expectations +- Lock file must be regenerated to reflect the transitive dependency update + +--- + +## CVE-2025-7783 - form-data Unsafe Random Function + +**Context:** Critical vulnerability (CVSS 9.1) - unsafe random function for boundary selection in multipart/form-data + +### Good Fix ✅ + +**Commit:** 461c4062fff765d43c39d76e6921c5e675866151 +**What worked well:** +- Used npm `overrides` field in root package.json to force form-data ^4.0.5 +- Updated ALL lock files in the monorepo (root, backend, frontend) +- Covered all transitive dependencies via single override + +**Key actions:** +```json +// In package.json +{ + "overrides": { + "form-data": "^4.0.5" + } +} +``` + +```bash +# Update all lock files in monorepo +npm install # Root +cd backend && npm install +cd ../frontend && npm install +``` + +**Files changed (4 total):** +- `package.json` (added overrides) +- `package-lock.json` +- `backend/package-lock.json` +- `frontend/package-lock.json` + +**Important considerations:** +- This is a monorepo - ALL workspaces need lock file updates +- npm overrides is the correct approach for forcing transitive dependency versions +- form-data 4.x has minor API changes from 3.x but most code is compatible +- Verify the override worked: `npm list form-data` + +**Testing performed:** +- Ran `npm list form-data` to confirm 4.0.5 is installed everywhere +- Confirmed `npm audit` no longer reports CVE-2025-7783 + +### Bad Fix ❌ + +**What to avoid:** +- Only updating the root lock file and forgetting backend/frontend workspaces +- Using exact version `4.0.5` instead of `^4.0.5` (prevents future patches) +- Not verifying the override worked across all transitive dependencies + +**Common mistakes:** +- Missing workspace lock files causes build failures in CI/CD +- Different versions in different workspaces creates inconsistency +- Not testing that multipart form uploads still work after the upgrade + +--- + +## CVE-2024-21538 - cross-spawn ReDoS Vulnerability + +**Context:** High severity (CVSS 7.5) Regular Expression Denial of Service in cross-spawn + +### Good Fix ✅ + +**Commit:** 05376dbd47fc4a9d523de5879b61bffc6a41525f +**What worked well:** +- Used npm overrides to force cross-spawn ^7.0.6 across all dependencies +- Updated all monorepo lock files (root, backend, frontend) +- This was a security patch with no breaking changes + +**Key actions:** +```json +// In package.json +{ + "overrides": { + "cross-spawn": "^7.0.6" + } +} +``` + +```bash +# Regenerate all lock files +npm install +cd backend && npm install +cd ../frontend && npm install +``` + +**Files changed (4 total):** +- `package.json` (added override) +- `package-lock.json` +- `backend/package-lock.json` +- `frontend/package-lock.json` + +**Important considerations:** +- cross-spawn is commonly used by build tools and test runners +- Version 7.0.6 is backward compatible with 7.0.x +- No code changes needed - pure dependency update + +**Testing performed:** +- Verified `npm list cross-spawn` shows 7.0.6 across all packages +- Confirmed npm audit clean for CVE-2024-21538 +- Build and test scripts still work (cross-spawn is used by many dev tools) + +### Bad Fix ❌ + +**What to avoid:** +- Only updating direct dependencies and missing transitive ones +- Using version range that includes vulnerable versions (e.g., `^7.0.0`) +- Not testing build/test commands that rely on cross-spawn + +--- + +## CVE-2023-26115 - word-wrap ReDoS Vulnerability + +**Context:** Moderate severity (CVSS 5.3) Regular Expression Denial of Service in word-wrap package + +### Good Fix ✅ + +**Commit:** e56e8a0730bf2dde2fb16534c49ff421ddbe77ca +**What worked well:** +- Used npm overrides for word-wrap ^1.2.5 +- Simple security patch with no API changes +- Updated all monorepo lock files + +**Key actions:** +```json +// In package.json +{ + "overrides": { + "word-wrap": "^1.2.5" + } +} +``` + +```bash +npm install +cd backend && npm install +cd ../frontend && npm install +``` + +**Files changed (4 total):** +- `package.json` +- `package-lock.json` +- `backend/package-lock.json` +- `frontend/package-lock.json` + +**Important considerations:** +- word-wrap is typically a transitive dependency (from other CLI/formatting tools) +- Version 1.2.5 is a pure security fix with no breaking changes +- No application code changes required + +### Bad Fix ❌ + +**What to avoid:** +- Trying to remove word-wrap entirely (other dependencies need it) +- Using exact version 1.2.5 instead of ^1.2.5 (prevents future patches) + +--- + +## CVE-2024-55565 - nanoid Non-Integer Value Handling + +**Context:** nanoid package mishandles non-integer values + +### Good Fix ✅ + +**Commit:** 20bb26b9076eb1e8ff7f58c4f65200c51383ccfd (same commit as path-to-regexp) +**What worked well:** +- Upgraded nanoid from 3.3.7 to 3.3.8 via package-lock.json update +- Pure security patch release +- No code changes needed + +**Key actions:** +```bash +npm update nanoid +# Or let it update via transitive dependency refresh +``` + +**Files changed:** +- `frontend/package-lock.json` + +**Important considerations:** +- nanoid 3.3.8 is a security patch with no breaking changes +- Used for generating unique IDs in the application +- Test that ID generation still works as expected + +### Bad Fix ❌ + +**What to avoid:** +- Upgrading to nanoid 4.x or 5.x (breaking changes, ESM-only) +- Not testing ID generation after upgrade + +--- + +## Common Patterns Across All Fixes + +### Lock File Management (CRITICAL for Monorepo) + +**This repository is a monorepo with multiple workspaces:** +- Root workspace +- `backend/` workspace +- `frontend/` workspace +- `packages/*/` workspaces + +**ALWAYS update ALL lock files:** +```bash +# Root +npm install + +# Backend workspace +cd backend && npm install && cd .. + +# Frontend workspace +cd frontend && npm install && cd .. + +# Verify all lock files changed +git status | grep package-lock.json +# Should show: package-lock.json, backend/package-lock.json, frontend/package-lock.json +``` + +### Using npm Overrides + +**For transitive dependencies (recommended approach):** +```json +{ + "overrides": { + "vulnerable-package": "^fixed.version.0" + } +} +``` + +**Why overrides work well:** +- Forces all transitive dependencies to use the fixed version +- Single declaration in root package.json +- npm automatically resolves across entire dependency tree + +### Testing Checklist + +After every CVE fix: +- [ ] Run `npm list ` to verify correct version +- [ ] Run `npm audit` to confirm CVE is resolved +- [ ] Run `npm run build` to ensure build still works +- [ ] Run `npm test` to ensure tests pass +- [ ] Check that lock files for ALL workspaces are updated + +### Commit Message Template + +``` +Fix CVE-YYYY-XXXXX: + +- Add npm override for ^ to fix CVE-YYYY-XXXXX +- Update all lock files in monorepo (root, backend, frontend) +- Resolves RHOAIENG-XXXXX, RHOAIENG-YYYYY + +CVE Details: +- CVE ID: CVE-YYYY-XXXXX +- Package: +- Severity: (CVSS ) +- Impact: +- Vulnerable versions: +- Fixed version: + +Files Changed ( total): +- package.json (added/updated overrides) +- package-lock.json +- backend/package-lock.json +- frontend/package-lock.json + +Breaking Changes: +- + +Testing: +- Verified @ via npm list +- Confirmed CVE no longer in npm audit + +Co-Authored-By: Claude Sonnet 4.5 +``` + +--- + +## Repository-Specific Rules + +1. **Always use npm overrides** for transitive dependency CVE fixes +2. **Always update ALL workspace lock files** (root, backend, frontend) +3. **Prefer caret ranges** (^x.y.z) over exact versions for future patches +4. **Test with npm audit** before and after to confirm fix +5. **Document Jira issue references** in commit messages +6. **Use Co-Authored-By** tag for AI-assisted commits + +--- + +## When Overrides Don't Work + +If npm overrides fail (rare), try these alternatives: + +1. **Direct dependency upgrade:** If the package is a direct dependency, upgrade it in package.json +2. **Resolutions field:** For yarn compatibility (if needed): `"resolutions": {"package": "version"}` +3. **Package manager specific:** Check if the issue is npm vs yarn vs pnpm specific + +--- + +## Summary + +**Most CVE fixes in this repository follow this pattern:** + +1. Add npm override in root `package.json` +2. Run `npm install` in root, backend, and frontend +3. Verify with `npm list ` and `npm audit` +4. Commit all lock files (3-4 files typically) +5. No application code changes usually needed + +**Key Success Factor:** ODH Dashboard is a monorepo - NEVER forget to update lock files in all workspaces!