dbf 5.3.0 → 5.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d2d1ca393ae41262fd052c74ffe0ec497a963a2c036797686061312a0c492888
-  data.tar.gz: 7e92c62ace7713b883b6b2e925c34f7a8114ebd6345b36a81f97fb47109711e2
+  metadata.gz: f296a6fc75892231410af21b2ee94490666f740f425f671078b5c28ded1e2977
+  data.tar.gz: eed4dfd84582cdf9c8e125ca2ddb1e882ebe75147321469db26166f7777a1ea1
 SHA512:
-  metadata.gz: f0f3b1b02ab53f505ab3efc1dff89d2ad1169698ef7d9443b3eec3b758b921ae2df51bf443d4e877ac072bdef87c547607d1d39d913a5c361b4c31e21fee4b07
-  data.tar.gz: 6d826dd35aa6e80b671aeb804dc9991776851bbb9ca0ff5fb9ed6cd7139cbd40b0bad68327fc8f17b03b9ba2f2b77479331b7ad998c53e7ee32e5caee59241e6
+  metadata.gz: 578f0f6cc7c88a205c38fd2ef93af2d8e5c924483018af4b96fb349dd12f40386c13547dfc67cd6fbdd47e191a0d04ef46bf0e1c38f9baec6057197661cd6945
+  data.tar.gz: 6960aba5a5b253cc6041c0822a504714ab5a511fee4ea1ff84f43cde10c8cf7db4d74d46f84e670d49f3a4d7110525a3196ea2f76cbcc37174a657e56a755fae

data/CHANGELOG.md

@@ -1,7 +1,26 @@
 # Changelog
 
-## main branch
-
+## 5.4.0
+
+- CLI: replace terminal control bytes in file-derived output so a crafted DBF cannot emit escape sequences to an interactive terminal; CSV and schema output are only filtered when writing to a terminal, so redirected exports are unchanged
+- Security (CWE-248): write binary or invalidly encoded cells in `Table#to_csv` as representable text instead of raising an encoding error
+- Security (CWE-248): replace unrepresentable column type bytes so a corrupt descriptor cannot raise when the schema is serialized to JSON
+- Security (CWE-248): `Table#record` returns nil when the file ends after the delete flag instead of crashing on a nil record body
+- Security (CWE-248): stop column parsing when the file ends mid-descriptor instead of raising `ArgumentError` from a short unpack
+- Security (CWE-248): guard FoxPro memo-pointer decoding against a nil value from a truncated record instead of crashing on nil.unpack1
+- Security (CWE-248): guard dBase IV memo reads against a nil/short block header instead of crashing on nil.unpack1
+- Security (CWE-248): guard dBase III memo reads against a start block past EOF instead of crashing on a nil block
+- Security (CWE-248): stop column parsing on a truncated descriptor instead of constructing an invalid column that crashes on a nil length
+- Security (CWE-248): decode truncated numeric cells (Currency, AutoIncrement) to blank instead of raising an uncaught `nil` crash
+- Security (CWE-248): handle truncated headers and missing column terminators gracefully instead of raising an uncaught `nil` crash during column parsing
+- Security (CWE-400): bound FoxPro memo reads by the memo file size so a crafted memo size cannot force a ~4 GiB allocation
+- Security (CWE-400): bound dBase IV memo reads by the memo file size so a crafted length field cannot force a ~4 GiB allocation
+- Security (CWE-835): bound record iteration by the bytes actually read so a crafted `record_count` (or zero `record_length`) cannot cause an unbounded loop
+- Security (CWE-789): bound the record read buffer by the file's actual size so a crafted header cannot force a multi-gigabyte allocation from a tiny file
+- Security (CWE-400): resolve FoxPro `.dbc` tables by scanning the directory instead of `Dir.glob`, preventing glob brace-expansion CPU exhaustion from a crafted object name
+- Security (CWE-22): confine Visual FoxPro `.dbc` table resolution to the database directory, preventing path traversal via a crafted container object name
+- Security (CWE-1236): neutralize spreadsheet formula injection in `Table#to_csv` by prefixing a quote to string cells/headers starting with `= + - @`
+- Security (CWE-94): escape table and column names when generating ActiveRecord/Sequel schemas, preventing Ruby code injection from crafted DBF header names
 - Add support for 8 more code pages (issue #98): Mazovia cp620 and Kamenický cp895 via vendored translation tables (new DBF::Encoder), plus macRoman, cp1255, cp1256, macCyrillic, macCentEuro and macGreek
 - Blank Visual FoxPro "T" (DateTime) columns now return nil instead of a Julian day-0 date
 - Blank "F" (Float) columns now return nil instead of 0.0, matching "N" (Number) behavior

data/lib/dbf/cli.rb

@@ -14,6 +14,50 @@ module DBF
         -c = export as CSV
     HELP
 
+    # Bytes a terminal interprets as control or escape sequences. A crafted
+    # DBF can carry these in column names and record values, so they are
+    # replaced before file-derived text reaches an interactive terminal.
+    CONTROL_BYTES = /[\x00-\x1F\x7F]/n
+    # The same, but keeping CR and LF so CSV row separators survive.
+    CONTROL_BYTES_KEEPING_NEWLINES = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/n
+
+    # Replaces terminal control bytes. Substitution happens on a byte copy so
+    # a value whose bytes are invalid in its encoding cannot raise here.
+    #
+    # @param value [Object]
+    # @param pattern [Regexp]
+    # @return [String]
+    def self.sanitize(value, pattern = CONTROL_BYTES)
+      string = value.to_s
+      string.b.gsub(pattern, '?').force_encoding(string.encoding)
+    end
+
+    # Wraps an IO so text written to an interactive terminal is stripped of
+    # control bytes. Redirected or piped output is never wrapped, so exported
+    # data is passed through unaltered.
+    class TerminalFilter
+      def initialize(io)
+        @io = io
+      end
+
+      def <<(data)
+        @io << CLI.sanitize(data, CONTROL_BYTES_KEEPING_NEWLINES)
+        self
+      end
+
+      def write(*data)
+        @io.write(*data.map { |datum| CLI.sanitize(datum, CONTROL_BYTES_KEEPING_NEWLINES) })
+      end
+
+      def method_missing(name, ...) # :nodoc:
+        @io.respond_to?(name) ? @io.send(name, ...) : super
+      end
+
+      def respond_to_missing?(name, include_private = false) # :nodoc:
+        @io.respond_to?(name, include_private) || super
+      end
+    end
+
     def self.run(argv, stdout: $stdout, stderr: $stderr)
       new(argv, stdout: stdout, stderr: stderr).run
     end
@@ -65,11 +109,11 @@ module DBF
     end
 
     def print_ar_schema(filename)
-      @stdout.puts DBF::Table.new(filename).schema(:activerecord)
+      @stdout.puts terminal_safe(DBF::Table.new(filename).schema(:activerecord))
     end
 
     def print_sequel_schema(filename)
-      @stdout.puts DBF::Table.new(filename).schema(:sequel)
+      @stdout.puts terminal_safe(DBF::Table.new(filename).schema(:sequel))
     end
 
     def print_summary(filename)
@@ -84,12 +128,27 @@ module DBF
       @stdout.puts 'Name             Type       Length     Decimal'
       @stdout.puts '-' * 78
       table.columns.each do |f|
-        @stdout.puts format('%-16s %-10s %-10s %-10s', f.name, f.type, f.length, f.decimal)
+        # Column names and types come from the file. Always replace control
+        # bytes here: they are never valid in a name and would otherwise both
+        # emit escape sequences and break the column alignment below.
+        @stdout.puts format('%-16s %-10s %-10s %-10s', self.class.sanitize(f.name), self.class.sanitize(f.type), f.length, f.decimal)
       end
     end
 
     def print_csv(filename)
-      DBF::Table.new(filename).to_csv(@stdout)
+      DBF::Table.new(filename).to_csv(interactive? ? TerminalFilter.new(@stdout) : @stdout)
+    end
+
+    # Exported data is only filtered when it is going to a terminal, so
+    # redirecting or piping still produces byte-for-byte the original values.
+    def terminal_safe(text)
+      return text unless interactive?
+
+      self.class.sanitize(text, CONTROL_BYTES_KEEPING_NEWLINES)
+    end
+
+    def interactive?
+      @stdout.respond_to?(:tty?) && @stdout.tty?
     end
   end
 end

data/lib/dbf/column.rb

@@ -38,7 +38,7 @@ module DBF
     def initialize(table, name, type, length, decimal)
       @table = table
       @name = clean(name)
-      @type = type
+      @type = clean_type(type)
       @length = length
       @decimal = decimal
 
@@ -85,6 +85,14 @@ module DBF
       @table.encode_string(value.strip.split("\x00", 2).first || +'')
     end
 
+    # The column type is a single ASCII character. A corrupt file can supply
+    # any byte, which would otherwise stay binary and raise when serialized
+    # (e.g. to JSON), so replace anything unrepresentable.
+    def clean_type(value) # :nodoc:
+      type = value.to_s.dup.force_encoding(Encoding::UTF_8)
+      type.valid_encoding? ? type : type.scrub('?')
+    end
+
     def type_cast_class # :nodoc:
       @type_cast_class ||= begin
         klass = @length == 0 ? ColumnType::Nil : TYPE_CAST_CLASS[type.to_sym]

data/lib/dbf/column_builder.rb

@@ -12,7 +12,15 @@ module DBF
       safe_seek do
         @data.seek(@version_config.header_size)
         [].tap do |columns|
-          columns << Column.new(*@version_config.read_column_args(@table, @data)) until end_of_record?
+          until end_of_record?
+            args = @version_config.read_column_args(@table, @data)
+            # A descriptor truncated by EOF is returned as nil, or unpacks to
+            # a nil length; stop rather than constructing an invalid column
+            # (which would crash on nil < 0).
+            break if args.nil? || args[3].nil?
+
+            columns << Column.new(*args)
+          end
         end
       end
     end
@@ -20,7 +28,12 @@ module DBF
     private
 
     def end_of_record?
-      safe_seek { @data.read(1).ord == 13 }
+      safe_seek do
+        byte = @data.read(1)
+        # A truncated file that ends before the 0x0D column terminator marks
+        # the end of the column list rather than crashing on nil.ord.
+        byte.nil? || byte.ord == 13
+      end
     end
 
     def safe_seek

data/lib/dbf/column_type.rb

@@ -20,6 +20,10 @@ module DBF
       end
 
       def decode(raw, &)
+        # A record truncated before this column yields a nil slice; treat it
+        # as blank rather than crashing in the type cast.
+        return blank_value if raw.nil?
+
         if skip_blank? && raw.count(' ') == raw.length
           blank_value
         else
@@ -49,7 +53,8 @@ module DBF
     class Currency < Base
       # @param value [String]
       def type_cast(value)
-        (value.unpack1('q<') / 10_000.0).to_f
+        int = value.unpack1('q<')
+        int && (int / 10_000.0).to_f
       end
     end
 
@@ -64,6 +69,8 @@ module DBF
       # @param value [String]
       def type_cast(value)
         bits = value.unpack1('B*')
+        return nil unless bits && bits.length >= 32
+
         sign_multiplier = bits[0] == '0' ? -1 : 1
         bits[1, 31].to_i(2) * sign_multiplier
       end

data/lib/dbf/database/foxpro.rb

@@ -47,11 +47,25 @@ module DBF
       # @param name [String]
       # @return [String]
       def table_path(name)
-        glob = File.join(@dirname, "#{name}.dbf")
-        path = Dir.glob(glob, File::FNM_CASEFOLD).first
+        name = name.to_s
+        raise DBF::FileNotFoundError, "related table not found: #{name}" if name.empty? || name.include?("\x00")
+
+        # Treat the container-supplied name as an untrusted basename so that
+        # path separators and ".." cannot escape the database directory.
+        # Match case-insensitively by scanning the directory rather than
+        # globbing, so glob metacharacters (`{}`, `*`, `?`, `[]`) in the name
+        # cannot trigger brace-expansion CPU exhaustion.
+        target = "#{File.basename(name)}.dbf"
+        entry = Dir.children(@dirname).find { |child| child.casecmp?(target) }
+        path = entry && File.join(@dirname, entry)
 
         raise DBF::FileNotFoundError, "related table not found: #{name}" unless path && File.exist?(path)
 
+        # Defense in depth: confirm the resolved file really is inside the
+        # database directory before opening it.
+        contained = File.realpath(path).start_with?("#{File.realpath(@dirname)}#{File::SEPARATOR}")
+        raise DBF::FileNotFoundError, "related table not found: #{name}" unless contained
+
         path
       end
 

data/lib/dbf/header.rb

@@ -2,9 +2,14 @@
 
 module DBF
   class Header
+    HEADER_SIZE = 32
+
     attr_reader :version, :record_count, :header_length, :record_length, :encoding_key, :encoding
 
     def initialize(data)
+      # Pad a nil or truncated header read so unpacking a short file yields
+      # empty values instead of raising.
+      data = data.to_s.b.ljust(HEADER_SIZE, "\x00")
       @version = data.unpack1('H2')
       @encoding_key = nil
       @encoding = nil

data/lib/dbf/memo/dbase3.rb

@@ -7,7 +7,12 @@ module DBF
         data.seek offset(start_block)
         memo_string = +''
         loop do
-          block = data.read(BLOCK_SIZE).gsub(/(\000|\032)/, '')
+          block = data.read(BLOCK_SIZE)
+          # A start block past EOF yields nil; return what we have rather
+          # than crashing on nil.gsub.
+          break if block.nil?
+
+          block = block.gsub(/(\000|\032)/, '')
           memo_string << block
           break if block.size < BLOCK_SIZE
         end

data/lib/dbf/memo/dbase4.rb

@@ -5,7 +5,21 @@ module DBF
     class Dbase4 < Base
       def build_memo(start_block) # :nodoc:
         data.seek offset(start_block)
-        data.read(data.read(BLOCK_HEADER_SIZE).unpack1('x4L'))
+
+        # A start block past EOF yields a nil/short header; return nil rather
+        # than crashing on nil.unpack1.
+        header = data.read(BLOCK_HEADER_SIZE)
+        return nil unless header && header.bytesize == BLOCK_HEADER_SIZE
+
+        length = header.unpack1('x4L')
+
+        # Bound the read by the bytes remaining so a crafted 32-bit length
+        # field cannot force a ~4 GiB allocation from a small memo file.
+        remaining = data.size - data.pos
+        length = remaining if length > remaining
+        return nil if length <= 0
+
+        data.read(length)
       end
     end
   end

data/lib/dbf/memo/foxpro.rb

@@ -23,11 +23,15 @@ module DBF
       private
 
       def read_memo_content(memo_string, memo_size) # :nodoc:
-        if memo_size > block_content_size
-          memo_string << @data.read(content_size(memo_size))
-        else
-          memo_string[0, memo_size]
-        end
+        return memo_string[0, memo_size] unless memo_size > block_content_size
+
+        # Bound the read by the bytes remaining so a crafted 32-bit memo_size
+        # cannot force a ~4 GiB allocation from a small memo file.
+        length = content_size(memo_size)
+        remaining = @data.size - @data.pos
+        length = remaining if length > remaining
+        memo_string << @data.read(length) if length.positive?
+        memo_string
       end
 
       def block_size # :nodoc:

data/lib/dbf/record.rb

@@ -83,7 +83,9 @@ module DBF
 
     def decode_memo_value(raw) # :nodoc:
       memo = @context.memo
-      return nil unless memo
+      # A record truncated before the memo column yields a nil pointer; skip
+      # decoding rather than crashing on nil.unpack1.
+      return nil unless memo && raw
 
       version = @context.version
       raw = raw.unpack1('V') if version == '30' || version == '31'

data/lib/dbf/record_iterator.rb

@@ -14,8 +14,13 @@ module DBF
       buf = read_buffer
       return unless buf
 
+      # Bound the iteration by the bytes actually read so a crafted
+      # record_count (or record_length == 0) cannot drive an unbounded loop.
+      max_records = @record_length > 0 ? buf.bytesize / @record_length : 0
+      count = @record_count < max_records ? @record_count : max_records
+
       pos = 0
-      @record_count.times do
+      count.times do
         if buf.getbyte(pos) == 0x2A
           yield nil
         else
@@ -29,7 +34,14 @@ module DBF
 
     def read_buffer
       @data.seek(@header_length)
-      @data.read(@record_length * @record_count)
+
+      # Bound the allocation by the bytes actually available so a crafted
+      # header (huge record_length * record_count) cannot force a giant read
+      # from a tiny file.
+      requested = @record_length * @record_count
+      available = @data.size - @header_length
+      available = 0 if available.negative?
+      @data.read(requested < available ? requested : available)
     end
   end
 end

data/lib/dbf/schema.rb

@@ -55,7 +55,7 @@ module DBF
 
     def activerecord_schema(*) # :nodoc:
       output = +"ActiveRecord::Schema.define do\n"
-      output << "  create_table \"#{name}\" do |t|\n"
+      output << "  create_table #{name.to_s.inspect} do |t|\n"
       columns.each do |column|
         output << "    t.column #{activerecord_schema_definition(column)}"
       end
@@ -66,7 +66,7 @@ module DBF
     def sequel_schema(table_only: false) # :nodoc:
       output = +''
       output << "Sequel.migration do\n  change do\n " unless table_only
-      output << "    create_table(:#{name}) do\n"
+      output << "    create_table(#{name.to_s.to_sym.inspect}) do\n"
       columns.each do |column|
         output << "      column #{sequel_schema_definition(column)}"
       end
@@ -84,7 +84,7 @@ module DBF
     # @param column [DBF::Column]
     # @return [String]
     def activerecord_schema_definition(column)
-      "\"#{column.underscored_name}\", #{schema_data_type(column, :activerecord)}\n"
+      "#{column.underscored_name.inspect}, #{schema_data_type(column, :activerecord)}\n"
     end
 
     # Sequel schema definition
@@ -92,7 +92,7 @@ module DBF
     # @param column [DBF::Column]
     # @return [String]
     def sequel_schema_definition(column)
-      ":#{column.underscored_name}, #{schema_data_type(column, :sequel)}\n"
+      "#{column.underscored_name.to_sym.inspect}, #{schema_data_type(column, :sequel)}\n"
     end
 
     def schema_data_type(column, format = :activerecord) # :nodoc:

data/lib/dbf/table.rb

@@ -7,6 +7,10 @@ module DBF
   class NoColumnsDefined < StandardError
   end
 
+  # Leading bytes that make a spreadsheet treat a CSV cell as a formula:
+  # "=", "+", "-", "@", tab, and carriage return.
+  CSV_FORMULA_TRIGGERS = [0x3D, 0x2B, 0x2D, 0x40, 0x09, 0x0D].freeze
+
   # DBF::Table is the primary interface to a single DBF file and provides
   # methods for enumerating and searching the records.
   class Table
@@ -132,6 +136,10 @@ module DBF
       return nil if deleted_record?
 
       record_data = @data.read(record_length)
+      # A file that ends immediately after the delete flag has no record body;
+      # treat it as absent rather than building a Record over nil data.
+      return nil unless record_data
+
       DBF::Record.new(record_data, record_context)
     end
 
@@ -148,8 +156,8 @@ module DBF
       else path_or_io
       end
       csv = CSV.new(io, force_quotes: true)
-      csv << column_names
-      each { |record| csv << record.to_a }
+      csv << column_names.map { |name| csv_safe_value(name) }
+      each { |record| csv << record.to_a.map { |value| csv_safe_value(value) } }
     end
 
     # Human readable version description
@@ -176,6 +184,31 @@ module DBF
 
     private
 
+    # Neutralizes spreadsheet formula injection (CWE-1236) on CSV export by
+    # prefixing a single quote to string cells that begin with a formula
+    # trigger character. Non-string values (numbers, dates, booleans) are
+    # returned unchanged. The leading byte is compared numerically so that a
+    # value whose bytes are invalid in its encoding cannot raise here.
+    def csv_safe_value(value) # :nodoc:
+      return value unless value.is_a?(::String)
+
+      value = csv_compatible(value)
+      return value unless CSV_FORMULA_TRIGGERS.include?(value.getbyte(0))
+
+      quote = +"'"
+      quote.force_encoding(value.encoding) + value
+    end
+
+    # A row is written as a single string, so a binary (General/OLE) or
+    # invalidly encoded cell would raise Encoding::CompatibilityError when
+    # combined with text cells. Represent those bytes instead of raising.
+    def csv_compatible(value) # :nodoc:
+      return value if value.ascii_only?
+      return value if value.valid_encoding? && value.encoding != Encoding::BINARY
+
+      value.dup.force_encoding(Encoding::UTF_8).scrub('?')
+    end
+
     def version_config
       @version_config ||= VersionConfig.new(version)
     end

data/lib/dbf/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DBF
-  VERSION = '5.3.0'
+  VERSION = '5.4.0'
 end

data/lib/dbf/version_config.rb

@@ -68,11 +68,22 @@ module DBF
       end
     end
 
+    # Returns the Column.new arguments for the next column descriptor, or nil
+    # when the file ends mid-descriptor. Unpacking a short descriptor would
+    # otherwise raise ArgumentError ("x outside of string").
     def read_column_args(table, io)
+      size, format, defaults = column_layout
+      data = io.read(size)
+      return nil unless data && data.bytesize == size
+
+      [table, *data.unpack(format), *defaults]
+    end
+
+    def column_layout # :nodoc:
       case version
-      when '02' then [table, *io.read(header_size * 2).unpack('A11 a C'), 0]
-      when '04', '8c' then [table, *io.read(48).unpack('A32 a C C x13')]
-      else [table, *io.read(header_size).unpack('A11 a x4 C2')]
+      when '02' then [header_size * 2, 'A11 a C', [0]]
+      when '04', '8c' then [48, 'A32 a C C x13', []]
+      else [header_size, 'A11 a x4 C2', []]
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dbf
 version: !ruby/object:Gem::Version
-  version: 5.3.0
+  version: 5.4.0
 platform: ruby
 authors:
 - Keith Morrison
@@ -79,7 +79,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.17
 specification_version: 4
 summary: Read xBase files
 test_files: []