dbf 5.2.0 → 5.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96b3352f6c6d2cc3a667c6f390021c4f99be7c83ff2b9c911ac38c75d4c261aa
-  data.tar.gz: b787cd0e14a34ea66e670f88e793bcbebc1ccbdc260721da08ccee5d3de2624a
+  metadata.gz: f296a6fc75892231410af21b2ee94490666f740f425f671078b5c28ded1e2977
+  data.tar.gz: eed4dfd84582cdf9c8e125ca2ddb1e882ebe75147321469db26166f7777a1ea1
 SHA512:
-  metadata.gz: 52ceab2c71a3093ff691be23a0a0590e4309fd88218e683032e12805585dea05dd97bebd0170f003e7678641810d5d9aa6b9731bb0af647a8508d015875312d2
-  data.tar.gz: 41b87283de2deea377a3c27436d621486af57bc0421e5bc84dc1bd1f304abf8d264d72d8dda80350666895ca604efd335b829fd1efc79720721027146fe56b7d
+  metadata.gz: 578f0f6cc7c88a205c38fd2ef93af2d8e5c924483018af4b96fb349dd12f40386c13547dfc67cd6fbdd47e191a0d04ef46bf0e1c38f9baec6057197661cd6945
+  data.tar.gz: 6960aba5a5b253cc6041c0822a504714ab5a511fee4ea1ff84f43cde10c8cf7db4d74d46f84e670d49f3a4d7110525a3196ea2f76cbcc37174a657e56a755fae

data/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 5.4.0
+
+- CLI: replace terminal control bytes in file-derived output so a crafted DBF cannot emit escape sequences to an interactive terminal; CSV and schema output are only filtered when writing to a terminal, so redirected exports are unchanged
+- Security (CWE-248): write binary or invalidly encoded cells in `Table#to_csv` as representable text instead of raising an encoding error
+- Security (CWE-248): replace unrepresentable column type bytes so a corrupt descriptor cannot raise when the schema is serialized to JSON
+- Security (CWE-248): `Table#record` returns nil when the file ends after the delete flag instead of crashing on a nil record body
+- Security (CWE-248): stop column parsing when the file ends mid-descriptor instead of raising `ArgumentError` from a short unpack
+- Security (CWE-248): guard FoxPro memo-pointer decoding against a nil value from a truncated record instead of crashing on nil.unpack1
+- Security (CWE-248): guard dBase IV memo reads against a nil/short block header instead of crashing on nil.unpack1
+- Security (CWE-248): guard dBase III memo reads against a start block past EOF instead of crashing on a nil block
+- Security (CWE-248): stop column parsing on a truncated descriptor instead of constructing an invalid column that crashes on a nil length
+- Security (CWE-248): decode truncated numeric cells (Currency, AutoIncrement) to blank instead of raising an uncaught `nil` crash
+- Security (CWE-248): handle truncated headers and missing column terminators gracefully instead of raising an uncaught `nil` crash during column parsing
+- Security (CWE-400): bound FoxPro memo reads by the memo file size so a crafted memo size cannot force a ~4 GiB allocation
+- Security (CWE-400): bound dBase IV memo reads by the memo file size so a crafted length field cannot force a ~4 GiB allocation
+- Security (CWE-835): bound record iteration by the bytes actually read so a crafted `record_count` (or zero `record_length`) cannot cause an unbounded loop
+- Security (CWE-789): bound the record read buffer by the file's actual size so a crafted header cannot force a multi-gigabyte allocation from a tiny file
+- Security (CWE-400): resolve FoxPro `.dbc` tables by scanning the directory instead of `Dir.glob`, preventing glob brace-expansion CPU exhaustion from a crafted object name
+- Security (CWE-22): confine Visual FoxPro `.dbc` table resolution to the database directory, preventing path traversal via a crafted container object name
+- Security (CWE-1236): neutralize spreadsheet formula injection in `Table#to_csv` by prefixing a quote to string cells/headers starting with `= + - @`
+- Security (CWE-94): escape table and column names when generating ActiveRecord/Sequel schemas, preventing Ruby code injection from crafted DBF header names
+- Add support for 8 more code pages (issue #98): Mazovia cp620 and Kamenický cp895 via vendored translation tables (new DBF::Encoder), plus macRoman, cp1255, cp1256, macCyrillic, macCentEuro and macGreek
+- Blank Visual FoxPro "T" (DateTime) columns now return nil instead of a Julian day-0 date
+- Blank "F" (Float) columns now return nil instead of 0.0, matching "N" (Number) behavior
+- Extract CLI logic into DBF::CLI class (bin/dbf is now a thin shim)
+- DBF::Table#to_csv now accepts an IO in addition to a String path
+- Fix broken link in README
+
 ## 5.2.0
 
 - Drop support for Ruby 3.1 and 3.2

data/README.md

@@ -10,7 +10,7 @@
 DBF is a small, fast Ruby library for reading dBase, xBase, Clipper, and FoxPro database files.
 
 * Project page: <https://github.com/infused/dbf>
-* API Documentation: <https://rubydoc.info/github/infused/dbf>
+* API Documentation: <https://rdoc.info/gems/dbf>
 * Report bugs: <https://github.com/infused/dbf/issues>
 * Questions: Email <mailto:keithm@infused.org> and put DBF somewhere in the
   subject line
@@ -21,7 +21,7 @@ NOTE: Beginning with version 5.2 we have dropped support for Ruby 3.2 and earlie
 NOTE: Beginning with version 4.3 we have dropped support for Ruby 3.0 and earlier.
 
 NOTE: Beginning with version 4 we have dropped support for Ruby 2.0, 2.1, 2.2, and 2.3. If you need support for these older Rubies,
-please use 3.0.x (<https://github.com/infused.org/dbf/tree/3_stable>)
+please use 3.0.x (<https://github.com/infused/dbf/tree/3_stable>)
 
 NOTE: Beginning with version 3 we have dropped support for Ruby 1.8 and 1.9. If you need support for older Rubies,
 please use 2.0.x (<https://github.com/infused/dbf/tree/2_stable>)
@@ -151,6 +151,7 @@ table = DBF::Table.new('dbf/books.dbf', nil, 'cp866')
 | 01 | cp437 | U.S. MS–DOS |
 | 02 | cp850 | International MS–DOS |
 | 03 | cp1252 | Windows ANSI |
+| 04 | macRoman | Standard Macintosh |
 | 08 | cp865 | Danish OEM |
 | 09 | cp437 | Dutch OEM |
 | 0a | cp850 | Dutch OEM* |
@@ -191,6 +192,8 @@ table = DBF::Table.new('dbf/books.dbf', nil, 'cp866')
 | 65 | cp866 | Russian MS–DOS |
 | 66 | cp865 | Nordic MS–DOS |
 | 67 | cp861 | Icelandic MS–DOS |
+| 68 | cp895 | Kamenický (Czech) MS–DOS |
+| 69 | cp620 | Mazovia (Polish) MS–DOS |
 | 6a | cp737 | Greek MS–DOS (437G) |
 | 6b | cp857 | Turkish MS–DOS |
 | 6c | cp863 | French–Canadian MS–DOS |
@@ -199,9 +202,14 @@ table = DBF::Table.new('dbf/books.dbf', nil, 'cp866')
 | 7a | cp936 | PRC GBK |
 | 7b | cp932 | Japanese Shift-JIS |
 | 7c | cp874 | Thai Windows/MS–DOS |
+| 7d | cp1255 | Hebrew Windows |
+| 7e | cp1256 | Arabic Windows |
 | 86 | cp737 | Greek OEM |
 | 87 | cp852 | Slovenian OEM |
 | 88 | cp857 | Turkish OEM |
+| 96 | macCyrillic | Russian Macintosh |
+| 97 | macCentEuro | Macintosh EE |
+| 98 | macGreek | Greek Macintosh |
 | c8 | cp1250 | Eastern European Windows |
 | c9 | cp1251 | Russian Windows |
 | ca | cp1254 | Turkish Windows |
@@ -328,16 +336,16 @@ at this time.
 | 04      | dBase IV without memo file                          | Y | Y | Y | Y | - | - | - | - | - | - | - | - | - | - | - | - | - |
 | 05      | dBase V without memo file                           | Y | Y | Y | Y | - | - | - | - | - | - | - | - | - | - | - | - | - |
 | 07      | Visual Objects 1.x                                  | Y | Y | Y | Y | - | - | - | - | - | - | - | - | - | - | - | - | - |
-| 30      | Visual FoxPro                                       | Y | Y | Y | Y | Y | Y | Y | Y | N | Y | N | Y | N | N | N | N | - |
-| 31      | Visual FoxPro with AutoIncrement                    | Y | Y | Y | Y | Y | Y | Y | Y | N | Y | N | Y | N | N | N | N | N |
-| 32      | Visual FoxPro with field type Varchar or Varbinary  | Y | Y | Y | Y | Y | Y | Y | Y | N | Y | N | Y | N | N | N | N | N |
+| 30      | Visual FoxPro                                       | Y | Y | Y | Y | Y | Y | Y | Y | N | Y | Y | Y | N | N | N | N | - |
+| 31      | Visual FoxPro with AutoIncrement                    | Y | Y | Y | Y | Y | Y | Y | Y | N | Y | Y | Y | N | N | N | N | N |
+| 32      | Visual FoxPro with field type Varchar or Varbinary  | Y | Y | Y | Y | Y | Y | Y | Y | N | Y | Y | Y | N | N | N | N | N |
 | 7b      | dBase IV with memo file                             | Y | Y | Y | Y | Y | Y | - | - | - | - | - | - | - | - | - | - | - |
 | 83      | dBase III with memo file                            | Y | Y | Y | Y | Y | - | - | - | - | - | - | - | - | - | - | - | - |
 | 87      | Visual Objects 1.x with memo file                   | Y | Y | Y | Y | Y | - | - | - | - | - | - | - | - | - | - | - | - |
 | 8b      | dBase IV with memo file                             | Y | Y | Y | Y | Y | - | - | - | - | - | - | - | - | N | - | - | - |
 | 8e      | dBase IV with SQL table                             | Y | Y | Y | Y | Y | - | - | - | - | - | - | - | - | N | - | - | - |
-| f5      | FoxPro with memo file                               | Y | Y | Y | Y | Y | Y | Y | Y | N | Y | N | Y | N | N | N | N | N |
-| fb      | FoxPro without memo file                            | Y | Y | Y | Y | - | Y | Y | Y | N | Y | N | Y | N | N | N | N | N |
+| f5      | FoxPro with memo file                               | Y | Y | Y | Y | Y | Y | Y | Y | N | Y | Y | Y | N | N | N | N | N |
+| fb      | FoxPro without memo file                            | Y | Y | Y | Y | - | Y | Y | Y | N | Y | Y | Y | N | N | N | N | N |
 
 Data type descriptions
 

data/bin/dbf

@@ -1,60 +1,8 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 Signal.trap('PIPE', 'SYSTEM_DEFAULT')
 
 require 'dbf'
-require 'dbf/version'
-require 'optparse'
 
-params = ARGV.getopts('h', 's', 'a', 'c', 'r', 'v')
-
-if params['v']
-  puts "dbf version: #{DBF::VERSION}"
-
-elsif params['h']
-  puts "usage: #{File.basename(__FILE__)} [-h|-s|-a|-c|-r] filename"
-  puts '  -h = print this message'
-  puts '  -v = print the DBF gem version'
-  puts '  -s = print summary information'
-  puts '  -a = create an ActiveRecord::Schema'
-  puts '  -r = create a Sequel migration'
-  puts '  -c = export as CSV'
-else
-
-  filename = ARGV.shift
-  abort 'You must supply a filename on the command line' unless filename
-
-  # create an ActiveRecord::Schema
-  if params['a']
-    table = DBF::Table.new filename
-    puts table.schema(:activerecord)
-  end
-
-  # create an Sequel::Migration
-  if params['r']
-    table = DBF::Table.new filename
-    puts table.schema(:sequel)
-  end
-
-  if params['s']
-    table = DBF::Table.new filename
-    puts
-    puts "Database: #{filename}"
-    puts "Type: (#{table.version}) #{table.version_description}"
-    puts "Encoding: #{table.header_encoding}" if table.header_encoding
-    puts "Memo File: #{table.has_memo_file? ? 'true' : 'false'}"
-    puts "Records: #{table.record_count}"
-
-    puts "\nFields:"
-    puts 'Name             Type       Length     Decimal'
-    puts '-' * 78
-    table.columns.each do |f|
-      puts format('%-16s %-10s %-10s %-10s', f.name, f.type, f.length, f.decimal)
-    end
-  end
-
-  if params['c']
-    table = DBF::Table.new filename
-    table.to_csv
-  end
-end
+exit DBF::CLI.run(ARGV)

data/lib/dbf/cli.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+require 'optparse'
+
+module DBF
+  class CLI
+    USAGE = <<~HELP
+      usage: dbf [-h|-s|-a|-c|-r] filename
+        -h = print this message
+        -v = print the DBF gem version
+        -s = print summary information
+        -a = create an ActiveRecord::Schema
+        -r = create a Sequel migration
+        -c = export as CSV
+    HELP
+
+    # Bytes a terminal interprets as control or escape sequences. A crafted
+    # DBF can carry these in column names and record values, so they are
+    # replaced before file-derived text reaches an interactive terminal.
+    CONTROL_BYTES = /[\x00-\x1F\x7F]/n
+    # The same, but keeping CR and LF so CSV row separators survive.
+    CONTROL_BYTES_KEEPING_NEWLINES = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/n
+
+    # Replaces terminal control bytes. Substitution happens on a byte copy so
+    # a value whose bytes are invalid in its encoding cannot raise here.
+    #
+    # @param value [Object]
+    # @param pattern [Regexp]
+    # @return [String]
+    def self.sanitize(value, pattern = CONTROL_BYTES)
+      string = value.to_s
+      string.b.gsub(pattern, '?').force_encoding(string.encoding)
+    end
+
+    # Wraps an IO so text written to an interactive terminal is stripped of
+    # control bytes. Redirected or piped output is never wrapped, so exported
+    # data is passed through unaltered.
+    class TerminalFilter
+      def initialize(io)
+        @io = io
+      end
+
+      def <<(data)
+        @io << CLI.sanitize(data, CONTROL_BYTES_KEEPING_NEWLINES)
+        self
+      end
+
+      def write(*data)
+        @io.write(*data.map { |datum| CLI.sanitize(datum, CONTROL_BYTES_KEEPING_NEWLINES) })
+      end
+
+      def method_missing(name, ...) # :nodoc:
+        @io.respond_to?(name) ? @io.send(name, ...) : super
+      end
+
+      def respond_to_missing?(name, include_private = false) # :nodoc:
+        @io.respond_to?(name, include_private) || super
+      end
+    end
+
+    def self.run(argv, stdout: $stdout, stderr: $stderr)
+      new(argv, stdout: stdout, stderr: stderr).run
+    end
+
+    def initialize(argv, stdout: $stdout, stderr: $stderr)
+      @argv = argv.dup
+      @stdout = stdout
+      @stderr = stderr
+    end
+
+    def run
+      params = OptionParser.new.getopts(@argv, 'h', 's', 'a', 'c', 'r', 'v')
+
+      if params['v']
+        print_version
+      elsif params['h']
+        print_help
+      else
+        filename = @argv.shift
+        return missing_filename unless filename
+
+        action = %w[a r s c].find { |flag| params[flag] }
+        case action
+        when 'a' then print_ar_schema(filename)
+        when 'r' then print_sequel_schema(filename)
+        when 's' then print_summary(filename)
+        when 'c' then print_csv(filename)
+        end
+      end
+      0
+    rescue DBF::FileNotFoundError => e
+      @stderr.puts "DBF::FileNotFoundError: #{e.message}"
+      1
+    end
+
+    private
+
+    def print_version
+      @stdout.puts "dbf version: #{DBF::VERSION}"
+    end
+
+    def print_help
+      @stdout.puts USAGE
+    end
+
+    def missing_filename
+      @stderr.puts 'You must supply a filename on the command line'
+      1
+    end
+
+    def print_ar_schema(filename)
+      @stdout.puts terminal_safe(DBF::Table.new(filename).schema(:activerecord))
+    end
+
+    def print_sequel_schema(filename)
+      @stdout.puts terminal_safe(DBF::Table.new(filename).schema(:sequel))
+    end
+
+    def print_summary(filename)
+      table = DBF::Table.new(filename)
+      @stdout.puts
+      @stdout.puts "Database: #{filename}"
+      @stdout.puts "Type: (#{table.version}) #{table.version_description}"
+      @stdout.puts "Encoding: #{table.header_encoding}" if table.header_encoding
+      @stdout.puts "Memo File: #{table.has_memo_file? ? 'true' : 'false'}"
+      @stdout.puts "Records: #{table.record_count}"
+      @stdout.puts "\nFields:"
+      @stdout.puts 'Name             Type       Length     Decimal'
+      @stdout.puts '-' * 78
+      table.columns.each do |f|
+        # Column names and types come from the file. Always replace control
+        # bytes here: they are never valid in a name and would otherwise both
+        # emit escape sequences and break the column alignment below.
+        @stdout.puts format('%-16s %-10s %-10s %-10s', self.class.sanitize(f.name), self.class.sanitize(f.type), f.length, f.decimal)
+      end
+    end
+
+    def print_csv(filename)
+      DBF::Table.new(filename).to_csv(interactive? ? TerminalFilter.new(@stdout) : @stdout)
+    end
+
+    # Exported data is only filtered when it is going to a terminal, so
+    # redirecting or piping still produces byte-for-byte the original values.
+    def terminal_safe(text)
+      return text unless interactive?
+
+      self.class.sanitize(text, CONTROL_BYTES_KEEPING_NEWLINES)
+    end
+
+    def interactive?
+      @stdout.respond_to?(:tty?) && @stdout.tty?
+    end
+  end
+end

data/lib/dbf/column.rb

@@ -38,7 +38,7 @@ module DBF
     def initialize(table, name, type, length, decimal)
       @table = table
       @name = clean(name)
-      @type = type
+      @type = clean_type(type)
       @length = length
       @decimal = decimal
 
@@ -58,8 +58,8 @@ module DBF
     # @param raw [String]
     # @yield [raw] for memo column resolution
     # @return decoded value
-    def decode(raw, &memo_handler)
-      type_cast_class.decode(raw, &memo_handler)
+    def decode(raw, &)
+      type_cast_class.decode(raw, &)
     end
 
     # Returns a Hash with :name, :type, :length, and :decimal keys
@@ -85,6 +85,14 @@ module DBF
       @table.encode_string(value.strip.split("\x00", 2).first || +'')
     end
 
+    # The column type is a single ASCII character. A corrupt file can supply
+    # any byte, which would otherwise stay binary and raise when serialized
+    # (e.g. to JSON), so replace anything unrepresentable.
+    def clean_type(value) # :nodoc:
+      type = value.to_s.dup.force_encoding(Encoding::UTF_8)
+      type.valid_encoding? ? type : type.scrub('?')
+    end
+
     def type_cast_class # :nodoc:
       @type_cast_class ||= begin
         klass = @length == 0 ? ColumnType::Nil : TYPE_CAST_CLASS[type.to_sym]

data/lib/dbf/column_builder.rb

@@ -12,7 +12,15 @@ module DBF
       safe_seek do
         @data.seek(@version_config.header_size)
         [].tap do |columns|
-          columns << Column.new(*@version_config.read_column_args(@table, @data)) until end_of_record?
+          until end_of_record?
+            args = @version_config.read_column_args(@table, @data)
+            # A descriptor truncated by EOF is returned as nil, or unpacks to
+            # a nil length; stop rather than constructing an invalid column
+            # (which would crash on nil < 0).
+            break if args.nil? || args[3].nil?
+
+            columns << Column.new(*args)
+          end
         end
       end
     end
@@ -20,7 +28,12 @@ module DBF
     private
 
     def end_of_record?
-      safe_seek { @data.read(1).ord == 13 }
+      safe_seek do
+        byte = @data.read(1)
+        # A truncated file that ends before the 0x0D column terminator marks
+        # the end of the column list rather than crashing on nil.ord.
+        byte.nil? || byte.ord == 13
+      end
     end
 
     def safe_seek

data/lib/dbf/column_type.rb

@@ -5,8 +5,7 @@ module DBF
     class Base
       attr_reader :decimal, :encoding
 
-      # @param decimal [Integer]
-      # @param encoding [String, Encoding]
+      # @param column [DBF::Column]
       def initialize(column)
         @decimal = column.decimal
         @encoding = column.encoding
@@ -20,7 +19,11 @@ module DBF
         false
       end
 
-      def decode(raw, &_memo_handler)
+      def decode(raw, &)
+        # A record truncated before this column yields a nil slice; treat it
+        # as blank rather than crashing in the type cast.
+        return blank_value if raw.nil?
+
         if skip_blank? && raw.count(' ') == raw.length
           blank_value
         else
@@ -50,7 +53,8 @@ module DBF
     class Currency < Base
       # @param value [String]
       def type_cast(value)
-        (value.unpack1('q<') / 10_000.0).to_f
+        int = value.unpack1('q<')
+        int && (int / 10_000.0).to_f
       end
     end
 
@@ -65,14 +69,20 @@ module DBF
       # @param value [String]
       def type_cast(value)
         bits = value.unpack1('B*')
+        return nil unless bits && bits.length >= 32
+
         sign_multiplier = bits[0] == '0' ? -1 : 1
         bits[1, 31].to_i(2) * sign_multiplier
       end
     end
 
     class Float < Base
+      def skip_blank? = true
+
       # @param value [String]
       def type_cast(value)
+        return nil if value.empty?
+
         value.to_f
       end
     end
@@ -111,6 +121,8 @@ module DBF
       # @param value [String]
       def type_cast(value)
         days, msecs = value.unpack('l2')
+        return nil if days.nil? || days.zero?
+
         secs = (msecs / 1000).to_i
         ::DateTime.jd(days, (secs / 3600).to_i, (secs / 60).to_i % 60, secs % 60).to_time
       rescue StandardError
@@ -119,8 +131,8 @@ module DBF
     end
 
     class Memo < Base
-      def decode(raw, &memo_handler)
-        memo_content = memo_handler.call(raw)
+      def decode(raw, &)
+        memo_content = yield(raw)
         memo_content ? type_cast(memo_content) : nil
       end
 
@@ -128,7 +140,7 @@ module DBF
       def type_cast(value)
         return value unless encoding && value
 
-        value.dup.force_encoding(encoding).encode(Encoding.default_external, undef: :replace, invalid: :replace)
+        Encoder.encode(value.dup, encoding)
       end
     end
 
@@ -158,8 +170,9 @@ module DBF
       private
 
       def encode(value)
-        value.force_encoding(encoding)
-        @needs_encode ? value.encode(@target_encoding, undef: :replace, invalid: :replace) : value
+        return value.force_encoding(encoding) unless @needs_encode
+
+        Encoder.encode(value, encoding, @target_encoding)
       end
     end
   end

data/lib/dbf/database/foxpro.rb

@@ -47,11 +47,25 @@ module DBF
       # @param name [String]
       # @return [String]
       def table_path(name)
-        glob = File.join(@dirname, "#{name}.dbf")
-        path = Dir.glob(glob, File::FNM_CASEFOLD).first
+        name = name.to_s
+        raise DBF::FileNotFoundError, "related table not found: #{name}" if name.empty? || name.include?("\x00")
+
+        # Treat the container-supplied name as an untrusted basename so that
+        # path separators and ".." cannot escape the database directory.
+        # Match case-insensitively by scanning the directory rather than
+        # globbing, so glob metacharacters (`{}`, `*`, `?`, `[]`) in the name
+        # cannot trigger brace-expansion CPU exhaustion.
+        target = "#{File.basename(name)}.dbf"
+        entry = Dir.children(@dirname).find { |child| child.casecmp?(target) }
+        path = entry && File.join(@dirname, entry)
 
         raise DBF::FileNotFoundError, "related table not found: #{name}" unless path && File.exist?(path)
 
+        # Defense in depth: confirm the resolved file really is inside the
+        # database directory before opening it.
+        contained = File.realpath(path).start_with?("#{File.realpath(@dirname)}#{File::SEPARATOR}")
+        raise DBF::FileNotFoundError, "related table not found: #{name}" unless contained
+
         path
       end
 

data/lib/dbf/encoder.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+module DBF
+  # Transcodes strings from a source encoding to a target encoding.
+  #
+  # Most DBF code pages map to encodings built into Ruby and are converted
+  # with String#encode. A few (Mazovia cp620, Kamenický cp895) have no Ruby
+  # equivalent and are decoded through vendored byte-to-Unicode tables.
+  module Encoder
+    # Byte-to-Unicode tables generated from
+    # https://github.com/SheetJS/js-codepage/blob/master/codepages/620.TBL and
+    # https://github.com/SheetJS/js-codepage/blob/master/codepages/895.TBL
+
+    # Mazovia (Polish) MS-DOS
+    CP620_TO_UNICODE = [
+      0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007,
+      0x0008, 0x0009, 0x000A, 0x000B, 0x000C, 0x000D, 0x000E, 0x000F,
+      0x0010, 0x0011, 0x0012, 0x0013, 0x0014, 0x0015, 0x0016, 0x0017,
+      0x0018, 0x0019, 0x001A, 0x001B, 0x001C, 0x001D, 0x001E, 0x001F,
+      0x0020, 0x0021, 0x0022, 0x0023, 0x0024, 0x0025, 0x0026, 0x0027,
+      0x0028, 0x0029, 0x002A, 0x002B, 0x002C, 0x002D, 0x002E, 0x002F,
+      0x0030, 0x0031, 0x0032, 0x0033, 0x0034, 0x0035, 0x0036, 0x0037,
+      0x0038, 0x0039, 0x003A, 0x003B, 0x003C, 0x003D, 0x003E, 0x003F,
+      0x0040, 0x0041, 0x0042, 0x0043, 0x0044, 0x0045, 0x0046, 0x0047,
+      0x0048, 0x0049, 0x004A, 0x004B, 0x004C, 0x004D, 0x004E, 0x004F,
+      0x0050, 0x0051, 0x0052, 0x0053, 0x0054, 0x0055, 0x0056, 0x0057,
+      0x0058, 0x0059, 0x005A, 0x005B, 0x005C, 0x005D, 0x005E, 0x005F,
+      0x0060, 0x0061, 0x0062, 0x0063, 0x0064, 0x0065, 0x0066, 0x0067,
+      0x0068, 0x0069, 0x006A, 0x006B, 0x006C, 0x006D, 0x006E, 0x006F,
+      0x0070, 0x0071, 0x0072, 0x0073, 0x0074, 0x0075, 0x0076, 0x0077,
+      0x0078, 0x0079, 0x007A, 0x007B, 0x007C, 0x007D, 0x007E, 0x007F,
+      0x00C7, 0x00FC, 0x00E9, 0x00E2, 0x00E4, 0x00E0, 0x0105, 0x00E7,
+      0x00EA, 0x00EB, 0x00E8, 0x00EF, 0x00EE, 0x0107, 0x00C4, 0x0104,
+      0x0118, 0x0119, 0x0142, 0x00F4, 0x00F6, 0x0106, 0x00FB, 0x00F9,
+      0x015A, 0x00D6, 0x00DC, 0x00A2, 0x0141, 0x00A5, 0x015B, 0x0192,
+      0x0179, 0x017B, 0x00F3, 0x00D3, 0x0144, 0x0143, 0x017A, 0x017C,
+      0x00BF, 0x2310, 0x00AC, 0x00BD, 0x00BC, 0x00A1, 0x00AB, 0x00BB,
+      0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556,
+      0x2555, 0x2563, 0x2551, 0x2557, 0x255D, 0x255C, 0x255B, 0x2510,
+      0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x255E, 0x255F,
+      0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x2567,
+      0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256B,
+      0x256A, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580,
+      0x03B1, 0x00DF, 0x0393, 0x03C0, 0x03A3, 0x03C3, 0x00B5, 0x03C4,
+      0x03A6, 0x0398, 0x03A9, 0x03B4, 0x221E, 0x03C6, 0x03B5, 0x2229,
+      0x2261, 0x00B1, 0x2265, 0x2264, 0x2320, 0x2321, 0x00F7, 0x2248,
+      0x00B0, 0x2219, 0x00B7, 0x221A, 0x207F, 0x00B2, 0x25A0, 0x00A0
+    ].freeze
+
+    # Kamenický (Czech) MS-DOS
+    CP895_TO_UNICODE = [
+      0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007,
+      0x0008, 0x0009, 0x000A, 0x000B, 0x000C, 0x000D, 0x000E, 0x000F,
+      0x0010, 0x0011, 0x0012, 0x0013, 0x0014, 0x0015, 0x0016, 0x0017,
+      0x0018, 0x0019, 0x001A, 0x001B, 0x001C, 0x001D, 0x001E, 0x001F,
+      0x0020, 0x0021, 0x0022, 0x0023, 0x0024, 0x0025, 0x0026, 0x0027,
+      0x0028, 0x0029, 0x002A, 0x002B, 0x002C, 0x002D, 0x002E, 0x002F,
+      0x0030, 0x0031, 0x0032, 0x0033, 0x0034, 0x0035, 0x0036, 0x0037,
+      0x0038, 0x0039, 0x003A, 0x003B, 0x003C, 0x003D, 0x003E, 0x003F,
+      0x0040, 0x0041, 0x0042, 0x0043, 0x0044, 0x0045, 0x0046, 0x0047,
+      0x0048, 0x0049, 0x004A, 0x004B, 0x004C, 0x004D, 0x004E, 0x004F,
+      0x0050, 0x0051, 0x0052, 0x0053, 0x0054, 0x0055, 0x0056, 0x0057,
+      0x0058, 0x0059, 0x005A, 0x005B, 0x005C, 0x005D, 0x005E, 0x005F,
+      0x0060, 0x0061, 0x0062, 0x0063, 0x0064, 0x0065, 0x0066, 0x0067,
+      0x0068, 0x0069, 0x006A, 0x006B, 0x006C, 0x006D, 0x006E, 0x006F,
+      0x0070, 0x0071, 0x0072, 0x0073, 0x0074, 0x0075, 0x0076, 0x0077,
+      0x0078, 0x0079, 0x007A, 0x007B, 0x007C, 0x007D, 0x007E, 0x007F,
+      0x010C, 0x00FC, 0x00E9, 0x010F, 0x00E4, 0x010E, 0x0164, 0x010D,
+      0x011B, 0x011A, 0x0139, 0x00CD, 0x013E, 0x01EA, 0x00C4, 0x00C1,
+      0x00C9, 0x017E, 0x017D, 0x00F4, 0x00F6, 0x00D3, 0x016F, 0x00DA,
+      0x00FD, 0x00D6, 0x00DC, 0x0160, 0x013D, 0x00DD, 0x0158, 0x0165,
+      0x00E1, 0x00ED, 0x00F3, 0x00FA, 0x0148, 0x0147, 0x016E, 0x00D4,
+      0x0161, 0x0159, 0x0155, 0x0154, 0x00BC, 0x00A7, 0x00AB, 0x00BB,
+      0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556,
+      0x2555, 0x2563, 0x2551, 0x2557, 0x255D, 0x255C, 0x255B, 0x2510,
+      0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x255E, 0x255F,
+      0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x2567,
+      0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256B,
+      0x256A, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580,
+      0x03B1, 0x00DF, 0x0393, 0x03C0, 0x03A3, 0x03C3, 0x00B5, 0x03C4,
+      0x03A6, 0x0398, 0x03A9, 0x03B4, 0x221E, 0x03C6, 0x03B5, 0x2229,
+      0x2261, 0x00B1, 0x2265, 0x2264, 0x2320, 0x2321, 0x00F7, 0x2248,
+      0x00B0, 0x2219, 0x00B7, 0x221A, 0x207F, 0x00B2, 0x25A0, 0x00A0
+    ].freeze
+
+    CUSTOM_TABLES = {
+      'cp620' => CP620_TO_UNICODE,
+      'cp895' => CP895_TO_UNICODE
+    }.freeze
+
+    # Is the encoding a code page without a Ruby Encoding, decoded through
+    # a vendored table?
+    #
+    # @param encoding [String, Encoding, nil]
+    # @return [Boolean]
+    def self.custom?(encoding)
+      encoding.is_a?(::String) && CUSTOM_TABLES.key?(encoding.downcase)
+    end
+
+    # Transcode a string from source_encoding to target_encoding
+    #
+    # @param string [String]
+    # @param source_encoding [String, Encoding]
+    # @param target_encoding [Encoding]
+    # @return [String]
+    def self.encode(string, source_encoding, target_encoding = Encoding.default_external)
+      table = source_encoding.is_a?(::String) && CUSTOM_TABLES[source_encoding.downcase]
+      if table
+        decoded = string.each_byte.map { |byte| table[byte] }.pack('U*')
+        target_encoding == Encoding::UTF_8 ? decoded : decoded.encode(target_encoding, undef: :replace, invalid: :replace)
+      else
+        string.force_encoding(source_encoding).encode(target_encoding, undef: :replace, invalid: :replace)
+      end
+    end
+  end
+end

data/lib/dbf/encodings.rb

@@ -5,6 +5,7 @@ module DBF
     '01' => 'cp437',       # U.S. MS-DOS
     '02' => 'cp850',       # International MS-DOS
     '03' => 'cp1252',      # Windows ANSI
+    '04' => 'macRoman',    # Standard Macintosh
     '08' => 'cp865',       # Danish OEM
     '09' => 'cp437',       # Dutch OEM
     '0a' => 'cp850',       # Dutch OEM*
@@ -45,6 +46,8 @@ module DBF
     '65' => 'cp866',       # Russian MS-DOS
     '66' => 'cp865',       # Nordic MS-DOS
     '67' => 'cp861',       # Icelandic MS-DOS
+    '68' => 'cp895',       # Kamenicky (Czech) MS-DOS
+    '69' => 'cp620',       # Mazovia (Polish) MS-DOS
     '6a' => 'cp737',       # Greek MS-DOS (437G)
     '6b' => 'cp857',       # Turkish MS-DOS
     '6c' => 'cp863',       # French-Canadian MS-DOS
@@ -53,9 +56,14 @@ module DBF
     '7a' => 'cp936',       # PRC GBK
     '7b' => 'cp932',       # Japanese Shift-JIS
     '7c' => 'cp874',       # Thai Windows/MS-DOS
+    '7d' => 'cp1255',      # Hebrew Windows
+    '7e' => 'cp1256',      # Arabic Windows
     '86' => 'cp737',       # Greek OEM
     '87' => 'cp852',       # Slovenian OEM
     '88' => 'cp857',       # Turkish OEM
+    '96' => 'macCyrillic', # Russian Macintosh
+    '97' => 'macCentEuro', # Macintosh EE
+    '98' => 'macGreek',    # Greek Macintosh
     'c8' => 'cp1250',      # Eastern European Windows
     'c9' => 'cp1251',      # Russian Windows
     'ca' => 'cp1254',      # Turkish Windows

data/lib/dbf/header.rb

@@ -2,9 +2,14 @@
 
 module DBF
   class Header
+    HEADER_SIZE = 32
+
     attr_reader :version, :record_count, :header_length, :record_length, :encoding_key, :encoding
 
     def initialize(data)
+      # Pad a nil or truncated header read so unpacking a short file yields
+      # empty values instead of raising.
+      data = data.to_s.b.ljust(HEADER_SIZE, "\x00")
       @version = data.unpack1('H2')
       @encoding_key = nil
       @encoding = nil

data/lib/dbf/memo/dbase3.rb

@@ -7,7 +7,12 @@ module DBF
         data.seek offset(start_block)
         memo_string = +''
         loop do
-          block = data.read(BLOCK_SIZE).gsub(/(\000|\032)/, '')
+          block = data.read(BLOCK_SIZE)
+          # A start block past EOF yields nil; return what we have rather
+          # than crashing on nil.gsub.
+          break if block.nil?
+
+          block = block.gsub(/(\000|\032)/, '')
           memo_string << block
           break if block.size < BLOCK_SIZE
         end

data/lib/dbf/memo/dbase4.rb

@@ -5,7 +5,21 @@ module DBF
     class Dbase4 < Base
       def build_memo(start_block) # :nodoc:
         data.seek offset(start_block)
-        data.read(data.read(BLOCK_HEADER_SIZE).unpack1('x4L'))
+
+        # A start block past EOF yields a nil/short header; return nil rather
+        # than crashing on nil.unpack1.
+        header = data.read(BLOCK_HEADER_SIZE)
+        return nil unless header && header.bytesize == BLOCK_HEADER_SIZE
+
+        length = header.unpack1('x4L')
+
+        # Bound the read by the bytes remaining so a crafted 32-bit length
+        # field cannot force a ~4 GiB allocation from a small memo file.
+        remaining = data.size - data.pos
+        length = remaining if length > remaining
+        return nil if length <= 0
+
+        data.read(length)
       end
     end
   end

data/lib/dbf/memo/foxpro.rb

@@ -23,11 +23,15 @@ module DBF
       private
 
       def read_memo_content(memo_string, memo_size) # :nodoc:
-        if memo_size > block_content_size
-          memo_string << @data.read(content_size(memo_size))
-        else
-          memo_string[0, memo_size]
-        end
+        return memo_string[0, memo_size] unless memo_size > block_content_size
+
+        # Bound the read by the bytes remaining so a crafted 32-bit memo_size
+        # cannot force a ~4 GiB allocation from a small memo file.
+        length = content_size(memo_size)
+        remaining = @data.size - @data.pos
+        length = remaining if length > remaining
+        memo_string << @data.read(length) if length.positive?
+        memo_string
       end
 
       def block_size # :nodoc:

data/lib/dbf/record.rb

@@ -83,7 +83,9 @@ module DBF
 
     def decode_memo_value(raw) # :nodoc:
       memo = @context.memo
-      return nil unless memo
+      # A record truncated before the memo column yields a nil pointer; skip
+      # decoding rather than crashing on nil.unpack1.
+      return nil unless memo && raw
 
       version = @context.version
       raw = raw.unpack1('V') if version == '30' || version == '31'

data/lib/dbf/record_iterator.rb

@@ -14,8 +14,13 @@ module DBF
       buf = read_buffer
       return unless buf
 
+      # Bound the iteration by the bytes actually read so a crafted
+      # record_count (or record_length == 0) cannot drive an unbounded loop.
+      max_records = @record_length > 0 ? buf.bytesize / @record_length : 0
+      count = @record_count < max_records ? @record_count : max_records
+
       pos = 0
-      @record_count.times do
+      count.times do
         if buf.getbyte(pos) == 0x2A
           yield nil
         else
@@ -29,7 +34,14 @@ module DBF
 
     def read_buffer
       @data.seek(@header_length)
-      @data.read(@record_length * @record_count)
+
+      # Bound the allocation by the bytes actually available so a crafted
+      # header (huge record_length * record_count) cannot force a giant read
+      # from a tiny file.
+      requested = @record_length * @record_count
+      available = @data.size - @header_length
+      available = 0 if available.negative?
+      @data.read(requested < available ? requested : available)
     end
   end
 end

data/lib/dbf/schema.rb

@@ -55,7 +55,7 @@ module DBF
 
     def activerecord_schema(*) # :nodoc:
       output = +"ActiveRecord::Schema.define do\n"
-      output << "  create_table \"#{name}\" do |t|\n"
+      output << "  create_table #{name.to_s.inspect} do |t|\n"
       columns.each do |column|
         output << "    t.column #{activerecord_schema_definition(column)}"
       end
@@ -66,7 +66,7 @@ module DBF
     def sequel_schema(table_only: false) # :nodoc:
       output = +''
       output << "Sequel.migration do\n  change do\n " unless table_only
-      output << "    create_table(:#{name}) do\n"
+      output << "    create_table(#{name.to_s.to_sym.inspect}) do\n"
       columns.each do |column|
         output << "      column #{sequel_schema_definition(column)}"
       end
@@ -84,7 +84,7 @@ module DBF
     # @param column [DBF::Column]
     # @return [String]
     def activerecord_schema_definition(column)
-      "\"#{column.underscored_name}\", #{schema_data_type(column, :activerecord)}\n"
+      "#{column.underscored_name.inspect}, #{schema_data_type(column, :activerecord)}\n"
     end
 
     # Sequel schema definition
@@ -92,7 +92,7 @@ module DBF
     # @param column [DBF::Column]
     # @return [String]
     def sequel_schema_definition(column)
-      ":#{column.underscored_name}, #{schema_data_type(column, :sequel)}\n"
+      "#{column.underscored_name.to_sym.inspect}, #{schema_data_type(column, :sequel)}\n"
     end
 
     def schema_data_type(column, format = :activerecord) # :nodoc:

data/lib/dbf/table.rb

@@ -7,6 +7,10 @@ module DBF
   class NoColumnsDefined < StandardError
   end
 
+  # Leading bytes that make a spreadsheet treat a CSV cell as a formula:
+  # "=", "+", "-", "@", tab, and carriage return.
+  CSV_FORMULA_TRIGGERS = [0x3D, 0x2B, 0x2D, 0x40, 0x09, 0x0D].freeze
+
   # DBF::Table is the primary interface to a single DBF file and provides
   # methods for enumerating and searching the records.
   class Table
@@ -132,6 +136,10 @@ module DBF
       return nil if deleted_record?
 
       record_data = @data.read(record_length)
+      # A file that ends immediately after the delete flag has no record body;
+      # treat it as absent rather than building a Record over nil data.
+      return nil unless record_data
+
       DBF::Record.new(record_data, record_context)
     end
 
@@ -140,11 +148,16 @@ module DBF
     # Dumps all records to a CSV file.  If no filename is given then CSV is
     # output to STDOUT.
     #
-    # @param [optional String] path Defaults to STDOUT
-    def to_csv(path = nil)
-      csv = CSV.new(path ? File.open(path, 'w') : $stdout, force_quotes: true)
-      csv << column_names
-      each { |record| csv << record.to_a }
+    # @param [optional String, IO] path_or_io String path, IO-like object, or nil for STDOUT
+    def to_csv(path_or_io = nil)
+      io = case path_or_io
+      when nil then $stdout
+      when String then File.open(path_or_io, 'w')
+      else path_or_io
+      end
+      csv = CSV.new(io, force_quotes: true)
+      csv << column_names.map { |name| csv_safe_value(name) }
+      each { |record| csv << record.to_a.map { |value| csv_safe_value(value) } }
     end
 
     # Human readable version description
@@ -159,7 +172,7 @@ module DBF
     # @param [String] string
     # @return [String]
     def encode_string(string) # :nodoc:
-      string.force_encoding(@encoding).encode(Encoding.default_external, undef: :replace, invalid: :replace)
+      Encoder.encode(string, @encoding)
     end
 
     # Encoding specified in the file header
@@ -171,6 +184,31 @@ module DBF
 
     private
 
+    # Neutralizes spreadsheet formula injection (CWE-1236) on CSV export by
+    # prefixing a single quote to string cells that begin with a formula
+    # trigger character. Non-string values (numbers, dates, booleans) are
+    # returned unchanged. The leading byte is compared numerically so that a
+    # value whose bytes are invalid in its encoding cannot raise here.
+    def csv_safe_value(value) # :nodoc:
+      return value unless value.is_a?(::String)
+
+      value = csv_compatible(value)
+      return value unless CSV_FORMULA_TRIGGERS.include?(value.getbyte(0))
+
+      quote = +"'"
+      quote.force_encoding(value.encoding) + value
+    end
+
+    # A row is written as a single string, so a binary (General/OLE) or
+    # invalidly encoded cell would raise Encoding::CompatibilityError when
+    # combined with text cells. Represent those bytes instead of raising.
+    def csv_compatible(value) # :nodoc:
+      return value if value.ascii_only?
+      return value if value.valid_encoding? && value.encoding != Encoding::BINARY
+
+      value.dup.force_encoding(Encoding::UTF_8).scrub('?')
+    end
+
     def version_config
       @version_config ||= VersionConfig.new(version)
     end

data/lib/dbf/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DBF
-  VERSION = '5.2.0'
+  VERSION = '5.4.0'
 end

data/lib/dbf/version_config.rb

@@ -68,11 +68,22 @@ module DBF
       end
     end
 
+    # Returns the Column.new arguments for the next column descriptor, or nil
+    # when the file ends mid-descriptor. Unpacking a short descriptor would
+    # otherwise raise ArgumentError ("x outside of string").
     def read_column_args(table, io)
+      size, format, defaults = column_layout
+      data = io.read(size)
+      return nil unless data && data.bytesize == size
+
+      [table, *data.unpack(format), *defaults]
+    end
+
+    def column_layout # :nodoc:
       case version
-      when '02' then [table, *io.read(header_size * 2).unpack('A11 a C'), 0]
-      when '04', '8c' then [table, *io.read(48).unpack('A32 a C C x13')]
-      else [table, *io.read(header_size).unpack('A11 a x4 C2')]
+      when '02' then [header_size * 2, 'A11 a C', [0]]
+      when '04', '8c' then [48, 'A32 a C C x13', []]
+      else [header_size, 'A11 a x4 C2', []]
       end
     end
   end

data/lib/dbf.rb

@@ -14,6 +14,7 @@ require 'dbf/record_context'
 require 'dbf/column_type'
 require 'dbf/column'
 require 'dbf/encodings'
+require 'dbf/encoder'
 require 'dbf/header'
 require 'dbf/version_config'
 require 'dbf/file_handler'
@@ -25,3 +26,4 @@ require 'dbf/memo/dbase3'
 require 'dbf/memo/dbase4'
 require 'dbf/memo/foxpro'
 require 'dbf/database/foxpro'
+require 'dbf/cli'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dbf
 version: !ruby/object:Gem::Version
-  version: 5.2.0
+  version: 5.4.0
 platform: ruby
 authors:
 - Keith Morrison
@@ -37,10 +37,12 @@ files:
 - bin/dbf
 - dbf.gemspec
 - lib/dbf.rb
+- lib/dbf/cli.rb
 - lib/dbf/column.rb
 - lib/dbf/column_builder.rb
 - lib/dbf/column_type.rb
 - lib/dbf/database/foxpro.rb
+- lib/dbf/encoder.rb
 - lib/dbf/encodings.rb
 - lib/dbf/file_handler.rb
 - lib/dbf/find.rb
@@ -77,7 +79,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.17
 specification_version: 4
 summary: Read xBase files
 test_files: []