Add .cve-fix/examples.md for CVE fixer workflow guidance (demo-with-cves)

.cve-fix/examples.md

@@ -0,0 +1,361 @@
+# CVE Fix Examples for ODH Dashboard
+
+This file contains real examples of CVE fixes applied to the ODH Dashboard repository. These patterns serve as guidance for the CVE fixer workflow to ensure consistent, successful fixes.
+
+---
+
+## CVE-2024-52798 - path-to-regexp ReDoS Vulnerability
+
+**Context:** Unpatched Regular Expression Denial of Service (ReDoS) in path-to-regexp 0.1.x used by Express.js
+
+### Good Fix ✅
+
+**Commit:** 20bb26b9076eb1e8ff7f58c4f65200c51383ccfd
+**What worked well:**
+- Upgraded Express from 4.21.1 to 4.21.2, which includes path-to-regexp 0.1.12
+- The fix was applied via Express's dependency tree (transitive dependency)
+- Only frontend/package-lock.json needed updating
+- No direct dependency changes required in package.json
+- Simple lock file update resolved the vulnerability
+
+**Key actions:**
+```bash
+# The fix came through Express upgrade
+npm update express  # Updates to 4.21.2
+# Express 4.21.2 → includes path-to-regexp 0.1.12 (fixed)
+```
+
+**Files changed:**
+- `frontend/package-lock.json` (express version + path-to-regexp nested dependency)
+
+**Important considerations:**
+- path-to-regexp is a transitive dependency of Express
+- Don't try to override path-to-regexp directly when it's deeply nested
+- Express upgrade is the correct approach for this CVE
+- Version 0.1.12 is a security patch with no breaking changes
+
+### Bad Fix ❌
+
+**What to avoid:**
+- Adding direct npm override for path-to-regexp when it's an Express dependency
+- Trying to upgrade path-to-regexp without upgrading Express
+- Forgetting to update package-lock.json after dependency changes
+
+**Why it didn't work:**
+- npm overrides can create version conflicts with Express's expectations
+- Lock file must be regenerated to reflect the transitive dependency update
+
+---
+
+## CVE-2025-7783 - form-data Unsafe Random Function
+
+**Context:** Critical vulnerability (CVSS 9.1) - unsafe random function for boundary selection in multipart/form-data
+
+### Good Fix ✅
+
+**Commit:** 461c4062fff765d43c39d76e6921c5e675866151
+**What worked well:**
+- Used npm `overrides` field in root package.json to force form-data ^4.0.5
+- Updated ALL lock files in the monorepo (root, backend, frontend)
+- Covered all transitive dependencies via single override
+
+**Key actions:**
+```json
+// In package.json
+{
+  "overrides": {
+    "form-data": "^4.0.5"
+  }
+}
+```
+
+```bash
+# Update all lock files in monorepo
+npm install  # Root
+cd backend && npm install
+cd ../frontend && npm install
+```
+
+**Files changed (4 total):**
+- `package.json` (added overrides)
+- `package-lock.json`
+- `backend/package-lock.json`
+- `frontend/package-lock.json`
+
+**Important considerations:**
+- This is a monorepo - ALL workspaces need lock file updates
+- npm overrides is the correct approach for forcing transitive dependency versions
+- form-data 4.x has minor API changes from 3.x but most code is compatible
+- Verify the override worked: `npm list form-data`
+
+**Testing performed:**
+- Ran `npm list form-data` to confirm 4.0.5 is installed everywhere
+- Confirmed `npm audit` no longer reports CVE-2025-7783
+
+### Bad Fix ❌
+
+**What to avoid:**
+- Only updating the root lock file and forgetting backend/frontend workspaces
+- Using exact version `4.0.5` instead of `^4.0.5` (prevents future patches)
+- Not verifying the override worked across all transitive dependencies
+
+**Common mistakes:**
+- Missing workspace lock files causes build failures in CI/CD
+- Different versions in different workspaces creates inconsistency
+- Not testing that multipart form uploads still work after the upgrade
+
+---
+
+## CVE-2024-21538 - cross-spawn ReDoS Vulnerability
+
+**Context:** High severity (CVSS 7.5) Regular Expression Denial of Service in cross-spawn
+
+### Good Fix ✅
+
+**Commit:** 05376dbd47fc4a9d523de5879b61bffc6a41525f
+**What worked well:**
+- Used npm overrides to force cross-spawn ^7.0.6 across all dependencies
+- Updated all monorepo lock files (root, backend, frontend)
+- This was a security patch with no breaking changes
+
+**Key actions:**
+```json
+// In package.json
+{
+  "overrides": {
+    "cross-spawn": "^7.0.6"
+  }
+}
+```
+
+```bash
+# Regenerate all lock files
+npm install
+cd backend && npm install
+cd ../frontend && npm install
+```
+
+**Files changed (4 total):**
+- `package.json` (added override)
+- `package-lock.json`
+- `backend/package-lock.json`
+- `frontend/package-lock.json`
+
+**Important considerations:**
+- cross-spawn is commonly used by build tools and test runners
+- Version 7.0.6 is backward compatible with 7.0.x
+- No code changes needed - pure dependency update
+
+**Testing performed:**
+- Verified `npm list cross-spawn` shows 7.0.6 across all packages
+- Confirmed npm audit clean for CVE-2024-21538
+- Build and test scripts still work (cross-spawn is used by many dev tools)
+
+### Bad Fix ❌
+
+**What to avoid:**
+- Only updating direct dependencies and missing transitive ones
+- Using version range that includes vulnerable versions (e.g., `^7.0.0`)
+- Not testing build/test commands that rely on cross-spawn
+
+---
+
+## CVE-2023-26115 - word-wrap ReDoS Vulnerability
+
+**Context:** Moderate severity (CVSS 5.3) Regular Expression Denial of Service in word-wrap package
+
+### Good Fix ✅
+
+**Commit:** e56e8a0730bf2dde2fb16534c49ff421ddbe77ca
+**What worked well:**
+- Used npm overrides for word-wrap ^1.2.5
+- Simple security patch with no API changes
+- Updated all monorepo lock files
+
+**Key actions:**
+```json
+// In package.json
+{
+  "overrides": {
+    "word-wrap": "^1.2.5"
+  }
+}
+```
+
+```bash
+npm install
+cd backend && npm install
+cd ../frontend && npm install
+```
+
+**Files changed (4 total):**
+- `package.json`
+- `package-lock.json`
+- `backend/package-lock.json`
+- `frontend/package-lock.json`
+
+**Important considerations:**
+- word-wrap is typically a transitive dependency (from other CLI/formatting tools)
+- Version 1.2.5 is a pure security fix with no breaking changes
+- No application code changes required
+
+### Bad Fix ❌
+
+**What to avoid:**
+- Trying to remove word-wrap entirely (other dependencies need it)
+- Using exact version 1.2.5 instead of ^1.2.5 (prevents future patches)
+
+---
+
+## CVE-2024-55565 - nanoid Non-Integer Value Handling
+
+**Context:** nanoid package mishandles non-integer values
+
+### Good Fix ✅
+
+**Commit:** 20bb26b9076eb1e8ff7f58c4f65200c51383ccfd (same commit as path-to-regexp)
+**What worked well:**
+- Upgraded nanoid from 3.3.7 to 3.3.8 via package-lock.json update
+- Pure security patch release
+- No code changes needed
+
+**Key actions:**
+```bash
+npm update nanoid
+# Or let it update via transitive dependency refresh
+```
+
+**Files changed:**
+- `frontend/package-lock.json`
+
+**Important considerations:**
+- nanoid 3.3.8 is a security patch with no breaking changes
+- Used for generating unique IDs in the application
+- Test that ID generation still works as expected
+
+### Bad Fix ❌
+
+**What to avoid:**
+- Upgrading to nanoid 4.x or 5.x (breaking changes, ESM-only)
+- Not testing ID generation after upgrade
+
+---
+
+## Common Patterns Across All Fixes
+
+### Lock File Management (CRITICAL for Monorepo)
+
+**This repository is a monorepo with multiple workspaces:**
+- Root workspace
+- `backend/` workspace
+- `frontend/` workspace
+- `packages/*/` workspaces
+
+**ALWAYS update ALL lock files:**
+```bash
+# Root
+npm install
+
+# Backend workspace
+cd backend && npm install && cd ..
+
+# Frontend workspace
+cd frontend && npm install && cd ..
+
+# Verify all lock files changed
+git status | grep package-lock.json
+# Should show: package-lock.json, backend/package-lock.json, frontend/package-lock.json
+```
+
+### Using npm Overrides
+
+**For transitive dependencies (recommended approach):**
+```json
+{
+  "overrides": {
+    "vulnerable-package": "^fixed.version.0"
+  }
+}
+```
+
+**Why overrides work well:**
+- Forces all transitive dependencies to use the fixed version
+- Single declaration in root package.json
+- npm automatically resolves across entire dependency tree
+
+### Testing Checklist
+
+After every CVE fix:
+- [ ] Run `npm list <package-name>` to verify correct version
+- [ ] Run `npm audit` to confirm CVE is resolved
+- [ ] Run `npm run build` to ensure build still works
+- [ ] Run `npm test` to ensure tests pass
+- [ ] Check that lock files for ALL workspaces are updated
+
+### Commit Message Template
+
+```
+Fix CVE-YYYY-XXXXX: <Package Name> <Vulnerability Type>
+
+- Add npm override for <package> ^<version> to fix CVE-YYYY-XXXXX
+- Update all lock files in monorepo (root, backend, frontend)
+- Resolves RHOAIENG-XXXXX, RHOAIENG-YYYYY
+
+CVE Details:
+- CVE ID: CVE-YYYY-XXXXX
+- Package: <package-name>
+- Severity: <SEVERITY> (CVSS <score>)
+- Impact: <brief description>
+- Vulnerable versions: <version range>
+- Fixed version: <version>
+
+Files Changed (<N> total):
+- package.json (added/updated overrides)
+- package-lock.json
+- backend/package-lock.json
+- frontend/package-lock.json
+
+Breaking Changes:
+- <list any breaking changes or "None">
+
+Testing:
+- Verified <package>@<version> via npm list
+- Confirmed CVE no longer in npm audit
+
+Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
+```
+
+---
+
+## Repository-Specific Rules
+
+1. **Always use npm overrides** for transitive dependency CVE fixes
+2. **Always update ALL workspace lock files** (root, backend, frontend)
+3. **Prefer caret ranges** (^x.y.z) over exact versions for future patches
+4. **Test with npm audit** before and after to confirm fix
+5. **Document Jira issue references** in commit messages
+6. **Use Co-Authored-By** tag for AI-assisted commits
+
+---
+
+## When Overrides Don't Work
+
+If npm overrides fail (rare), try these alternatives:
+
+1. **Direct dependency upgrade:** If the package is a direct dependency, upgrade it in package.json
+2. **Resolutions field:** For yarn compatibility (if needed): `"resolutions": {"package": "version"}`
+3. **Package manager specific:** Check if the issue is npm vs yarn vs pnpm specific
+
+---
+
+## Summary
+
+**Most CVE fixes in this repository follow this pattern:**
+
+1. Add npm override in root `package.json`
+2. Run `npm install` in root, backend, and frontend
+3. Verify with `npm list <package>` and `npm audit`
+4. Commit all lock files (3-4 files typically)
+5. No application code changes usually needed
+
+**Key Success Factor:** ODH Dashboard is a monorepo - NEVER forget to update lock files in all workspaces!