rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: tagify can pass a malicious placeholder to initiate the cross-site scripting (XSS) payload This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the cross-site scripting (XSS) payload.
Vulnerability ID: GHSA-pxpf-v376-7xx5
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/yairEO/tagify
Published: 2022-04-30
File: src/tagify.js
Commit message: fixes #989 - fix XSS
Commit author: Yair Even Or

Vulnerable version (before fix):
 Tagify.prototype = {          _s.disabled = input.hasAttribute('disabled')         _s.readonly = _s.readonly || input.hasAttribute('readonly')         _s.placeholder = input.getAttribute('placeholder') || _s.placeholder || ""         _s.required = input.hasAttribute('required')          for( let name in _s.classNames )

Fixed version (after fix):
 Tagify.prototype = {          _s.disabled = input.hasAttribute('disabled')         _s.readonly = _s.readonly || input.hasAttribute('readonly')         _s.placeholder = escapeHTML(input.getAttribute('placeholder') || _s.placeholder || "")         _s.required = input.hasAttribute('required')          for( let name in _s.classNames )

Patch:
patch: @@ -101,7 +101,7 @@ Tagify.prototype = {
 
         _s.disabled = input.hasAttribute('disabled')
         _s.readonly = _s.readonly || input.hasAttribute('readonly')
-        _s.placeholder = input.getAttribute('placeholder') || _s.placeholder || ""
+        _s.placeholder = escapeHTML(input.getAttribute('placeholder') || _s.placeholder || "")
         _s.required = input.hasAttribute('required')
 
         for( let name in _s.classNames )
path: src/tagify.js
Vulnerability: Cross-site scripting in Joplin Joplin allows XSS via a LINK element in a note.
Vulnerability ID: GHSA-q26w-wjj2-22vv
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/laurent22/joplin
Published: 2021-05-10
File: ReactNativeClient/lib/joplin-renderer/htmlUtils.js
Commit message: All: Security: Remove "link" and "meta" tags from notes to prevent XSS
Commit author: Laurent Cozic

Vulnerable version (before fix):
 class HtmlUtils { 			return tagStack[tagStack.length - 1]; 		};  		// The BASE tag allows changing the base URL from which files are loaded, and 		// that can break several plugins, such as Katex (which needs to load CSS 		// files using a relative URL). For that reason it is disabled. 		// More info: https://github.com/laurent22/joplin/issues/3021 		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed'];  		const parser = new htmlparser2.Parser({ 

Fixed version (after fix):
 class HtmlUtils { 			return tagStack[tagStack.length - 1]; 		};  		// The BASE tag allows changing the base URL from which files are 		// loaded, and that can break several plugins, such as Katex (which 		// needs to load CSS files using a relative URL). For that reason 		// it is disabled. More info: 		// https://github.com/laurent22/joplin/issues/3021 		// 		// "link" can be used to escape the parser and inject JavaScript. 		// Adding "meta" too for the same reason as it shouldn't be used in 		// notes anyway. 		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta'];  		const parser = new htmlparser2.Parser({ 

Patch:
patch: @@ -87,11 +87,16 @@ class HtmlUtils {
 			return tagStack[tagStack.length - 1];
 		};
 
-		// The BASE tag allows changing the base URL from which files are loaded, and
-		// that can break several plugins, such as Katex (which needs to load CSS
-		// files using a relative URL). For that reason it is disabled.
-		// More info: https://github.com/laurent22/joplin/issues/3021
-		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed'];
+		// The BASE tag allows changing the base URL from which files are
+		// loaded, and that can break several plugins, such as Katex (which
+		// needs to load CSS files using a relative URL). For that reason
+		// it is disabled. More info:
+		// https://github.com/laurent22/joplin/issues/3021
+		//
+		// "link" can be used to escape the parser and inject JavaScript.
+		// Adding "meta" too for the same reason as it shouldn't be used in
+		// notes anyway.
+		const disallowedTags = ['script', 'iframe', 'frameset', 'frame', 'object', 'base', 'embed', 'link', 'meta'];
 
 		const parser = new htmlparser2.Parser({
path: ReactNativeClient/lib/joplin-renderer/htmlUtils.js
Vulnerability: Unrestricted XML files leading to cross-site scripting in Microweber Microweber prior to 1.2.12 allows unrestricted upload of XML files, which malicious actors can exploit to cause a stored cross-site scripting attack.
Vulnerability ID: GHSA-q3x2-jvp3-wj78
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/microweber/microweber
Published: 2022-03-16
File: src/MicroweberPackages/Utils/System/Files.php
Commit message: Update Files.php
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
 function get_allowed_files_extensions_for_upload($fileTypes = 'images', $returnA                 break;             case 'file':             case 'files':                 $are_allowed .= ',doc,docx,pdf,json,rtf,txt,zip,gzip,rar,cad,xml,psd,xlsx,csv,7z';                 break;             case 'documents':             case 'doc':                 $are_allowed .= ',doc,docx,pdf,log,msg,odt,pages,rtf,tex,txt,wpd,wps,pps,ppt,pptx,xml,xlr,xls,xlsx';                 break;             case 'archives':             case 'arc':

Fixed version (after fix):
 function get_allowed_files_extensions_for_upload($fileTypes = 'images', $returnA                 break;             case 'file':             case 'files':                 $are_allowed .= ',doc,docx,pdf,json,rtf,txt,zip,gzip,rar,cad,psd,xlsx,csv,7z';                  break;             case 'documents':             case 'doc':                 $are_allowed .= ',doc,docx,pdf,log,msg,odt,pages,rtf,tex,txt,wpd,wps,pps,ppt,pptx,xlr,xls,xlsx';                 break;             case 'archives':             case 'arc':

Patch:
patch: @@ -1154,11 +1154,11 @@ function get_allowed_files_extensions_for_upload($fileTypes = 'images', $returnA
                 break;
             case 'file':
             case 'files':
-                $are_allowed .= ',doc,docx,pdf,json,rtf,txt,zip,gzip,rar,cad,xml,psd,xlsx,csv,7z';
+                $are_allowed .= ',doc,docx,pdf,json,rtf,txt,zip,gzip,rar,cad,psd,xlsx,csv,7z'; 
                 break;
             case 'documents':
             case 'doc':
-                $are_allowed .= ',doc,docx,pdf,log,msg,odt,pages,rtf,tex,txt,wpd,wps,pps,ppt,pptx,xml,xlr,xls,xlsx';
+                $are_allowed .= ',doc,docx,pdf,log,msg,odt,pages,rtf,tex,txt,wpd,wps,pps,ppt,pptx,xlr,xls,xlsx';
                 break;
             case 'archives':
             case 'arc':
path: src/MicroweberPackages/Utils/System/Files.php
Vulnerability: Integer Overflow in png-img An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file.
Vulnerability ID: GHSA-q5wr-fvpq-p67g
CWE: CWE-787
Severity score: 8.8
Project: https://github.com/gemini-testing/png-img
Published: 2021-12-10
File: src/PngImg.cc
Commit message: Handle image size overflow
Commit author: Mikhail Cheshkov

Vulnerable version (before fix):
 void PngImg::ReadInfo_(PngReadStruct& rs) { /// void PngImg::InitStorage_() {     rowPtrs_.resize(info_.height, nullptr);     data_ = new png_byte[info_.height * info_.rowbytes];      for(size_t i = 0; i < info_.height; ++i) {         rowPtrs_[i] = data_ + i * info_.rowbytes;     } } 

Fixed version (after fix):
 void PngImg::ReadInfo_(PngReadStruct& rs) { /// void PngImg::InitStorage_() {     rowPtrs_.resize(info_.height, nullptr);     // Extend height and rowbytes from uint32_t to size_t to avoid multiplication overflow when size_t is larger     size_t h = info_.height;     size_t rb = info_.rowbytes;     // We need to make sure that info_.height * info_.rowbytes will not overflow size_t     // Unfotunately, there's no simple and portable way to do this in C++     // For integer division of positive numbers a * b > c <==> a > c / b holds     if (h > std::numeric_limits<size_t>::max() / rb) {         // TODO Propagate this exception to JS, and test it         throw std::runtime_error("Image is too large to allocate single buffer");     }     data_ = new png_byte[h * rb];      for(size_t i = 0; i < info_.height; ++i) {         rowPtrs_[i] = data_ + i * rb;     } } 

Patch:
patch: @@ -60,10 +60,20 @@ void PngImg::ReadInfo_(PngReadStruct& rs) {
 ///
 void PngImg::InitStorage_() {
     rowPtrs_.resize(info_.height, nullptr);
-    data_ = new png_byte[info_.height * info_.rowbytes];
+    // Extend height and rowbytes from uint32_t to size_t to avoid multiplication overflow when size_t is larger
+    size_t h = info_.height;
+    size_t rb = info_.rowbytes;
+    // We need to make sure that info_.height * info_.rowbytes will not overflow size_t
+    // Unfotunately, there's no simple and portable way to do this in C++
+    // For integer division of positive numbers a * b > c <==> a > c / b holds
+    if (h > std::numeric_limits<size_t>::max() / rb) {
+        // TODO Propagate this exception to JS, and test it
+        throw std::runtime_error("Image is too large to allocate single buffer");
+    }
+    data_ = new png_byte[h * rb];
 
     for(size_t i = 0; i < info_.height; ++i) {
-        rowPtrs_[i] = data_ + i * info_.rowbytes;
+        rowPtrs_[i] = data_ + i * rb;
     }
 }
path: src/PngImg.cc
Vulnerability: Integer Overflow in png-img An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file.
Vulnerability ID: GHSA-q5wr-fvpq-p67g
CWE: CWE-190
Severity score: 8.8
Project: https://github.com/gemini-testing/png-img
Published: 2021-12-10
File: src/PngImg.cc
Commit message: Handle image size overflow
Commit author: Mikhail Cheshkov

Vulnerable version (before fix):
 void PngImg::ReadInfo_(PngReadStruct& rs) { /// void PngImg::InitStorage_() {     rowPtrs_.resize(info_.height, nullptr);     data_ = new png_byte[info_.height * info_.rowbytes];      for(size_t i = 0; i < info_.height; ++i) {         rowPtrs_[i] = data_ + i * info_.rowbytes;     } } 

Fixed version (after fix):
 void PngImg::ReadInfo_(PngReadStruct& rs) { /// void PngImg::InitStorage_() {     rowPtrs_.resize(info_.height, nullptr);     // Extend height and rowbytes from uint32_t to size_t to avoid multiplication overflow when size_t is larger     size_t h = info_.height;     size_t rb = info_.rowbytes;     // We need to make sure that info_.height * info_.rowbytes will not overflow size_t     // Unfotunately, there's no simple and portable way to do this in C++     // For integer division of positive numbers a * b > c <==> a > c / b holds     if (h > std::numeric_limits<size_t>::max() / rb) {         // TODO Propagate this exception to JS, and test it         throw std::runtime_error("Image is too large to allocate single buffer");     }     data_ = new png_byte[h * rb];      for(size_t i = 0; i < info_.height; ++i) {         rowPtrs_[i] = data_ + i * rb;     } } 

Patch:
patch: @@ -60,10 +60,20 @@ void PngImg::ReadInfo_(PngReadStruct& rs) {
 ///
 void PngImg::InitStorage_() {
     rowPtrs_.resize(info_.height, nullptr);
-    data_ = new png_byte[info_.height * info_.rowbytes];
+    // Extend height and rowbytes from uint32_t to size_t to avoid multiplication overflow when size_t is larger
+    size_t h = info_.height;
+    size_t rb = info_.rowbytes;
+    // We need to make sure that info_.height * info_.rowbytes will not overflow size_t
+    // Unfotunately, there's no simple and portable way to do this in C++
+    // For integer division of positive numbers a * b > c <==> a > c / b holds
+    if (h > std::numeric_limits<size_t>::max() / rb) {
+        // TODO Propagate this exception to JS, and test it
+        throw std::runtime_error("Image is too large to allocate single buffer");
+    }
+    data_ = new png_byte[h * rb];
 
     for(size_t i = 0; i < info_.height; ++i) {
-        rowPtrs_[i] = data_ + i * info_.rowbytes;
+        rowPtrs_[i] = data_ + i * rb;
     }
 }
path: src/PngImg.cc
Vulnerability: Cross-site Scripting in Pimcore Pimcore version 10.3.2 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 10.3.3.
Vulnerability ID: GHSA-q67f-3jq4-mww2
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/pimcore/pimcore
Published: 2022-03-05
File: bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js
Commit message: escaping 'key' custom property field in elements
Commit author: JiaJia Ji

Vulnerable version (before fix):
 pimcore.element.properties = Class.create({      addSetFromUserDefined: function (customKey, customType) {         try {             if (in_array(customKey.getValue(), this.disallowedKeys)) {                 Ext.MessageBox.alert(t("error"), t("name_is_not_allowed"));             }             this.add(customKey.getValue(), customType.getValue(), false, false, false, true);         } catch (e) {             console.log(e);         }

Fixed version (after fix):
 pimcore.element.properties = Class.create({      addSetFromUserDefined: function (customKey, customType) {         try {             let key = htmlspecialchars(customKey.getValue());             if (in_array(key, this.disallowedKeys)) {                 Ext.MessageBox.alert(t("error"), t("name_is_not_allowed"));             }             this.add(key, customType.getValue(), false, false, false, true);         } catch (e) {             console.log(e);         }

Patch:
patch: @@ -568,10 +568,11 @@ pimcore.element.properties = Class.create({
 
     addSetFromUserDefined: function (customKey, customType) {
         try {
-            if (in_array(customKey.getValue(), this.disallowedKeys)) {
+            let key = htmlspecialchars(customKey.getValue());
+            if (in_array(key, this.disallowedKeys)) {
                 Ext.MessageBox.alert(t("error"), t("name_is_not_allowed"));
             }
-            this.add(customKey.getValue(), customType.getValue(), false, false, false, true);
+            this.add(key, customType.getValue(), false, false, false, true);
         } catch (e) {
             console.log(e);
         }
path: bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js
Vulnerability: Cross-site Scripting in microweber Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
Vulnerability ID: GHSA-q6mp-562x-ggvv
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/microweber/microweber
Published: 2022-07-05
File: src/MicroweberPackages/Utils/System/Files.php
Commit message: update
Commit author: Peter Ivanov

Vulnerable version (before fix):
 function get_allowed_files_extensions_for_upload($fileTypes = 'images', $returnA                 break;             case 'file':             case 'files':                 $are_allowed .= ',css,json,zip,gzip,csv,7z';                 break;             case 'documents':             case 'doc':                 $are_allowed .= ',doc,docx,pdf,odt,pages,rtf,txt,pps,ppt,pptx,xls,xlsx';                 break;             case 'archives':             case 'arc':

Fixed version (after fix):
 function get_allowed_files_extensions_for_upload($fileTypes = 'images', $returnA                 break;             case 'file':             case 'files':                 $are_allowed .= ',css,json,zip,gzip,psd,csv,7z';                 break;             case 'documents':             case 'doc':                 $are_allowed .= ',doc,docx,pdf,odt,rtf,txt,pps,ppt,pptx,xls,xlsx';                 break;             case 'archives':             case 'arc':

Patch:
patch: @@ -1154,11 +1154,11 @@ function get_allowed_files_extensions_for_upload($fileTypes = 'images', $returnA
                 break;
             case 'file':
             case 'files':
-                $are_allowed .= ',css,json,zip,gzip,csv,7z';
+                $are_allowed .= ',css,json,zip,gzip,psd,csv,7z';
                 break;
             case 'documents':
             case 'doc':
-                $are_allowed .= ',doc,docx,pdf,odt,pages,rtf,txt,pps,ppt,pptx,xls,xlsx';
+                $are_allowed .= ',doc,docx,pdf,odt,rtf,txt,pps,ppt,pptx,xls,xlsx';
                 break;
             case 'archives':
             case 'arc':
path: src/MicroweberPackages/Utils/System/Files.php
Vulnerability: Cross-site Scripting in ShowDoc ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via file upload.
Vulnerability ID: GHSA-q73m-3q7r-fpf7
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/star7th/showdoc
Published: 2022-03-16
File: server/Application/Api/Model/AttachmentModel.class.php
Commit message: Merge pull request #1632 from ajaysenr/master

Update AttachmentModel.class.php
Commit author: star7th

Vulnerable version (before fix):
 public function isAllowedFilename($filename){ 		$allow_array = array( 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp', 			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv', 			'.mov','.webmv','.m3u8a','.flac','.mkv', 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub', 			'.pdf','.ofd','.swf','.epub','.xps', 			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps','.wpt',

Fixed version (after fix):
 public function isAllowedFilename($filename){ 		$allow_array = array( 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp', 			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv', 			'.mov','.webmv','.flac','.mkv', 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub', 			'.pdf','.ofd','.swf','.epub','.xps', 			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps','.wpt',

Patch:
patch: @@ -325,7 +325,7 @@ public function isAllowedFilename($filename){
 		$allow_array = array(
 			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
 			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv',
-			'.mov','.webmv','.m3u8a','.flac','.mkv',
+			'.mov','.webmv','.flac','.mkv',
 			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub',
 			'.pdf','.ofd','.swf','.epub','.xps',
 			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps','.wpt',
path: server/Application/Api/Model/AttachmentModel.class.php
Vulnerability: Cross-site Scripting (XSS) in Apache Ambari Views A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.
Vulnerability ID: GHSA-q7q9-w24q-cpgh
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/apache/ambari
Published: 2022-01-06
File: ambari-web/app/views/common/breadcrumbs_view.js
Commit message: AMBARI-25329. Ambari breadcrumbs xss vulnerability
Commit author: Alex Antonenko

Vulnerable version (before fix):
 App.BreadcrumbItem = Em.Object.extend({   createLabel() {     let label = this.get('label');     let labelBindingPath = this.get('labelBindingPath');      let formattedLabel = labelBindingPath ? App.get(_getLabelPathWithoutApp(labelBindingPath)) : label;     this.set('formattedLabel', this.labelPostFormat(formattedLabel));   },  App.BreadcrumbsView = Em.View.extend({       }       currentState = currentState.get('parentState');     }     items = items.reverse().map(item => App.BreadcrumbItem.extend(item).create());     if (items.length) {       items.get('lastObject').setProperties({         disabled: true,

Fixed version (after fix):
 App.BreadcrumbItem = Em.Object.extend({   createLabel() {     let label = this.get('label');     let labelBindingPath = this.get('labelBindingPath');     let formattedLabel;      if (labelBindingPath) {       formattedLabel = Ember.Handlebars.Utils.escapeExpression(App.get(_getLabelPathWithoutApp(labelBindingPath)));     } else{       formattedLabel = label;     }        this.set('formattedLabel', this.labelPostFormat(formattedLabel));   },  App.BreadcrumbsView = Em.View.extend({       }       currentState = currentState.get('parentState');     }     items.reverse();     items.slice(1).forEach(item => item.label = Ember.Handlebars.Utils.escapeExpression(item.label));     items = items.map(item => App.BreadcrumbItem.extend(item).create());     if (items.length) {       items.get('lastObject').setProperties({         disabled: true,

Patch:
patch: @@ -149,8 +149,16 @@ App.BreadcrumbItem = Em.Object.extend({
   createLabel() {
     let label = this.get('label');
     let labelBindingPath = this.get('labelBindingPath');
+    let formattedLabel;
+
+    if (labelBindingPath) {
+      formattedLabel = Ember.Handlebars.Utils.escapeExpression(App.get(_getLabelPathWithoutApp(labelBindingPath)));
+    } else{
+      formattedLabel = label;
+    }
+
+
 
-    let formattedLabel = labelBindingPath ? App.get(_getLabelPathWithoutApp(labelBindingPath)) : label;
     this.set('formattedLabel', this.labelPostFormat(formattedLabel));
   },
 
@@ -216,7 +224,9 @@ App.BreadcrumbsView = Em.View.extend({
       }
       currentState = currentState.get('parentState');
     }
-    items = items.reverse().map(item => App.BreadcrumbItem.extend(item).create());
+    items.reverse();
+    items.slice(1).forEach(item => item.label = Ember.Handlebars.Utils.escapeExpression(item.label));
+    items = items.map(item => App.BreadcrumbItem.extend(item).create());
     if (items.length) {
       items.get('lastObject').setProperties({
         disabled: true,
path: ambari-web/app/views/common/breadcrumbs_view.js
Vulnerability: SQL Injection in Fork CMS Fork CMS contains a SQL injection vulnerability in versions prior to version 5.11.1. When deleting submissions which belong to a formular (made with module `FormBuilder`), the parameter `id[]` is vulnerable to SQL injection.
Vulnerability ID: GHSA-q863-cchm-c6c6
CWE: CWE-89
Severity score: 7.5
Project: https://github.com/forkcms/forkcms
Published: 2022-03-25
File: src/Backend/Modules/FormBuilder/Engine/Model.php
Commit message: Prevent sql injection through the ids of the action
Commit author: Jelmer Prins

Vulnerable version (before fix):
 public static function delete(int $id): void     public static function deleteData(array $ids): void     {         $database = BackendModel::getContainer()->get('database');          $database->delete('forms_data', 'id IN(' . implode(',', $ids) . ')');         $database->delete('forms_data_fields', 'data_id IN(' . implode(',', $ids) . ')');

Fixed version (after fix):
 public static function delete(int $id): void     public static function deleteData(array $ids): void     {         $database = BackendModel::getContainer()->get('database');         $ids = array_map('intval', $ids);          $database->delete('forms_data', 'id IN(' . implode(',', $ids) . ')');         $database->delete('forms_data_fields', 'data_id IN(' . implode(',', $ids) . ')');

Patch:
patch: @@ -152,6 +152,7 @@ public static function delete(int $id): void
     public static function deleteData(array $ids): void
     {
         $database = BackendModel::getContainer()->get('database');
+        $ids = array_map('intval', $ids);
 
         $database->delete('forms_data', 'id IN(' . implode(',', $ids) . ')');
         $database->delete('forms_data_fields', 'data_id IN(' . implode(',', $ids) . ')');
path: src/Backend/Modules/FormBuilder/Engine/Model.php