dbf 5.3.0 → 5.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d2d1ca393ae41262fd052c74ffe0ec497a963a2c036797686061312a0c492888
-  data.tar.gz: 7e92c62ace7713b883b6b2e925c34f7a8114ebd6345b36a81f97fb47109711e2
+  metadata.gz: ff36c9c3d6b7a558cd5bf0f703f64f0cb7b22cbf6b4c52b843c855328a712a0a
+  data.tar.gz: ac0f725043e7dc9102a32381f6041e54ebd852a67a264778ae58b2a59430b01e
 SHA512:
-  metadata.gz: f0f3b1b02ab53f505ab3efc1dff89d2ad1169698ef7d9443b3eec3b758b921ae2df51bf443d4e877ac072bdef87c547607d1d39d913a5c361b4c31e21fee4b07
-  data.tar.gz: 6d826dd35aa6e80b671aeb804dc9991776851bbb9ca0ff5fb9ed6cd7139cbd40b0bad68327fc8f17b03b9ba2f2b77479331b7ad998c53e7ee32e5caee59241e6
+  metadata.gz: 269035188f9741d80575efca78ae0bda153c4f27c79dbe3f3e6221fc714be22eb2fb9ec39899dcfc9d489f76d60bfaf1f892d6eeaaeea80fa406f5f401e909d7
+  data.tar.gz: 6203ede51060bad9d193b15bb98d814aa870d99dd29d6eb8ddd4cb2b5e04f078f522fb7f3051befcbebe11be86a13307da38f9981bbcb704c5307ebdb16dd6a3

data/CHANGELOG.md

@@ -1,7 +1,72 @@
 # Changelog
 
-## main branch
-
+## 5.5.0
+
+### Added
+
+- `DBF::Table.new` accepts any IO-like object responding to `#read` and `#seek` (`File`, `Tempfile`, …) in addition to a path or `StringIO`, matching what the README already documented; IO inputs are switched to binary mode, and memo auto-discovery works from the IO's path when it has one
+- `DBF::Error` base class: all library errors (`FileNotFoundError`, `NoColumnsDefined`, `Column::LengthError`, `Column::InvalidNameError`) now inherit from it, so callers can `rescue DBF::Error` to catch anything the library raises
+- `Table#filename` now works for any IO input with a path, not only `File`
+- `DBF::Table.open`: same arguments as `.new`, but the block form yields the table, closes it when the block returns, and returns the block's value — the same contract as `File.open`
+- CI: lint job running RuboCop and Reek on every push and pull request
+- CI: test on Windows and macOS (Ruby 3.4) in addition to Linux, since much real-world DBF data originates on Windows/FoxPro systems
+- CI: observe-only (non-blocking) test jobs for JRuby, TruffleRuby, and Ruby head
+- CI: enforce a 99% minimum test coverage floor via SimpleCov
+- Docs site (dbf.infused.org): YARD docs are now built and deployed by CI instead of being committed to the repository; the Pages workflow's deprecated v2/v3 actions (whose artifact backend was shut down in early 2025) are updated to current versions, repairing the broken deploy
+- Dependabot updates for GitHub Actions and gems (weekly), a security policy (SECURITY.md) with private vulnerability reporting, and contributor documentation (CONTRIBUTING.md)
+- Automated releases: pushing a `vX.Y.Z` tag now builds and publishes the gem to RubyGems.org from CI via Trusted Publishing (OIDC) — no long-lived API key. `bundler/gem_tasks` is loaded in the Rakefile, providing `rake build` / `rake release`. Git tags resume at v5.4.0; versions 4.0.0–5.3.0 were released without tags
+
+- Ractor safety: all library constants are verified Ractor-shareable and reading/exporting tables inside non-main Ractors is covered by specs
+- CLI: `-j` exports records as a JSON array and `-J` as JSON Lines (one record per line, streamed in constant memory); deleted records are skipped, control bytes are escaped by JSON itself, and binary cells are scrubbed instead of raising
+
+### Fixed
+
+- `Table#to_csv(path)` closes the file it opens, so the CSV is fully flushed to disk when the method returns (previously the data could stay buffered until garbage collection)
+- Visual FoxPro: a `.dbc` container supplying fewer long names than the table has columns no longer crashes column building; missing long names fall back to the table's own column names. Column rebuilding is also no longer O(n²)
+- `Table#schema` validates the format against the documented list up front; a `NoMethodError` raised inside a valid schema generator is no longer misreported as "not a valid schema"
+- FoxPro memo files shorter than their 512-byte header no longer crash memo reads (they return nil like other truncations)
+- RuboCop config: restore the default `vendor/**/*` exclusion (overriding `Exclude` replaces the defaults), fixing a CI lint crash where RuboCop descended into cached vendored gems and tried to load plugins from their configs
+- CLI: close the table when finished, so the DBF file can be deleted or replaced immediately afterwards on Windows (an open handle blocks deletion there)
+
+### Removed
+
+- CodeClimate config and README badges: the service is sunset, and coverage is now enforced directly in CI
+
+### Changed
+
+- Streaming reads: `Table#each` now reads records in 4 MB chunks of whole records instead of loading the entire record section into memory, so enumerating multi-gigabyte files (for example shapefile `.dbf` sidecars) uses bounded memory. On a 190 MB file, peak process memory drops from ~222 MB to ~35 MB with identical results. No API change; all malformed-file bounds are preserved
+- Internal: `DBF::RecordContext` is now an immutable `Data` class instead of a `Struct`
+- Internal: remove a redundant `Memo::Foxpro#initialize` and the duplicate `Header::HEADER_SIZE` constant (now sourced from `VersionConfig`)
+- README: replace the stack of version-support notes with a compatibility table, point API docs at dbf.infused.org, and refer to LICENSE instead of inlining the full MIT text; copyright years updated through 2026
+- Gemspec: add `homepage_uri`, `bug_tracker_uri`, `documentation_uri`, and `funding_uri` metadata (shown on the rubygems.org sidebar), and constrain the `csv` runtime dependency to `~> 3.3`
+- `DBF::Column::NameError` is renamed to `DBF::Column::InvalidNameError` (it shadowed Ruby's `::NameError` without being one); the old constant remains as a deprecated alias
+- Rescues in date/datetime decoding and FoxPro memo reads are narrowed to the specific expected errors, so genuine programmer errors surface instead of silently returning nil
+- Declare `reek` and `simplecov` as direct development dependencies instead of relying on rubycritic's transitive dependencies
+- Restrict `debug` and `ruby-lsp` to MRI so `bundle install` succeeds on JRuby/TruffleRuby
+- Test matrix no longer fails fast, and a Ruby head regression no longer fails the build
+- Update pinned `ruby/setup-ruby` action to v1.321.0
+
+## 5.4.0
+
+- CLI: replace terminal control bytes in file-derived output so a crafted DBF cannot emit escape sequences to an interactive terminal; CSV and schema output are only filtered when writing to a terminal, so redirected exports are unchanged
+- Security (CWE-248): write binary or invalidly encoded cells in `Table#to_csv` as representable text instead of raising an encoding error
+- Security (CWE-248): replace unrepresentable column type bytes so a corrupt descriptor cannot raise when the schema is serialized to JSON
+- Security (CWE-248): `Table#record` returns nil when the file ends after the delete flag instead of crashing on a nil record body
+- Security (CWE-248): stop column parsing when the file ends mid-descriptor instead of raising `ArgumentError` from a short unpack
+- Security (CWE-248): guard FoxPro memo-pointer decoding against a nil value from a truncated record instead of crashing on nil.unpack1
+- Security (CWE-248): guard dBase IV memo reads against a nil/short block header instead of crashing on nil.unpack1
+- Security (CWE-248): guard dBase III memo reads against a start block past EOF instead of crashing on a nil block
+- Security (CWE-248): stop column parsing on a truncated descriptor instead of constructing an invalid column that crashes on a nil length
+- Security (CWE-248): decode truncated numeric cells (Currency, AutoIncrement) to blank instead of raising an uncaught `nil` crash
+- Security (CWE-248): handle truncated headers and missing column terminators gracefully instead of raising an uncaught `nil` crash during column parsing
+- Security (CWE-400): bound FoxPro memo reads by the memo file size so a crafted memo size cannot force a ~4 GiB allocation
+- Security (CWE-400): bound dBase IV memo reads by the memo file size so a crafted length field cannot force a ~4 GiB allocation
+- Security (CWE-835): bound record iteration by the bytes actually read so a crafted `record_count` (or zero `record_length`) cannot cause an unbounded loop
+- Security (CWE-789): bound the record read buffer by the file's actual size so a crafted header cannot force a multi-gigabyte allocation from a tiny file
+- Security (CWE-400): resolve FoxPro `.dbc` tables by scanning the directory instead of `Dir.glob`, preventing glob brace-expansion CPU exhaustion from a crafted object name
+- Security (CWE-22): confine Visual FoxPro `.dbc` table resolution to the database directory, preventing path traversal via a crafted container object name
+- Security (CWE-1236): neutralize spreadsheet formula injection in `Table#to_csv` by prefixing a quote to string cells/headers starting with `= + - @`
+- Security (CWE-94): escape table and column names when generating ActiveRecord/Sequel schemas, preventing Ruby code injection from crafted DBF header names
 - Add support for 8 more code pages (issue #98): Mazovia cp620 and Kamenický cp895 via vendored translation tables (new DBF::Encoder), plus macRoman, cp1255, cp1256, macCyrillic, macCentEuro and macGreek
 - Blank Visual FoxPro "T" (DateTime) columns now return nil instead of a Julian day-0 date
 - Blank "F" (Float) columns now return nil instead of 0.0, matching "N" (Number) behavior

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2006-2024 Keith Morrison <keithm@infused.org>
+Copyright (c) 2006-2026 Keith Morrison <keithm@infused.org>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -2,36 +2,37 @@
 
 [![Version](https://img.shields.io/gem/v/dbf.svg?style=flat)](https://rubygems.org/gems/dbf)
 [![Build Status](https://github.com/infused/dbf/actions/workflows/build.yml/badge.svg)](https://github.com/infused/dbf/actions/workflows/build.yml)
-[![Code Quality](https://img.shields.io/codeclimate/maintainability/infused/dbf.svg?style=flat)](https://codeclimate.com/github/infused/dbf)
-[![Code Coverage](https://img.shields.io/codeclimate/c/infused/dbf.svg?style=flat)](https://codeclimate.com/github/infused/dbf)
 [![Total Downloads](https://img.shields.io/gem/dt/dbf.svg)](https://rubygems.org/gems/dbf/)
 [![License](https://img.shields.io/github/license/infused/dbf.svg)](https://github.com/infused/dbf)
 
 DBF is a small, fast Ruby library for reading dBase, xBase, Clipper, and FoxPro database files.
 
 * Project page: <https://github.com/infused/dbf>
-* API Documentation: <https://rdoc.info/gems/dbf>
+* API Documentation: <https://dbf.infused.org>
 * Report bugs: <https://github.com/infused/dbf/issues>
 * Questions: Email <mailto:keithm@infused.org> and put DBF somewhere in the
   subject line
 * Change log: <https://github.com/infused/dbf/blob/main/CHANGELOG.md>
 
-NOTE: Beginning with version 5.2 we have dropped support for Ruby 3.2 and earlier.
-
-NOTE: Beginning with version 4.3 we have dropped support for Ruby 3.0 and earlier.
-
-NOTE: Beginning with version 4 we have dropped support for Ruby 2.0, 2.1, 2.2, and 2.3. If you need support for these older Rubies,
-please use 3.0.x (<https://github.com/infused/dbf/tree/3_stable>)
-
-NOTE: Beginning with version 3 we have dropped support for Ruby 1.8 and 1.9. If you need support for older Rubies,
-please use 2.0.x (<https://github.com/infused/dbf/tree/2_stable>)
-
 ## Compatibility
 
 DBF is tested to work with the following versions of Ruby:
 
 * Ruby 3.3.x, 3.4.x, 4.0.x
 
+Older Rubies are supported by older DBF release lines:
+
+| DBF version | Ruby support |
+| ----------- | ------------ |
+| 5.2+        | 3.3+         |
+| 4.3 – 5.1   | 3.1+         |
+| 4.0 – 4.2   | 2.4+         |
+| 3.x ([3_stable](https://github.com/infused/dbf/tree/3_stable)) | 2.0 – 2.3 |
+| 2.x ([2_stable](https://github.com/infused/dbf/tree/2_stable)) | 1.8 – 1.9 |
+
+DBF is Ractor-friendly: all library constants are deeply frozen, so tables
+can be opened, enumerated, and exported inside non-main Ractors.
+
 ## Installation
 
 Install the gem manually:
@@ -58,16 +59,35 @@ widgets = DBF::Table.new("widgets.dbf")
 Open a DBF file using an IO object:
 
 ```ruby
-data = File.open('widgets.dbf')
+data = File.open('widgets.dbf', 'rb')
 widgets = DBF::Table.new(data)
 ```
 
+All errors raised by the library inherit from DBF::Error, so you can rescue
+the library as a unit:
+
+```ruby
+begin
+  widgets = DBF::Table.new("widgets.dbf")
+rescue DBF::Error => e
+  puts "Unable to read DBF file: #{e.message}"
+end
+```
+
 Open a DBF by passing in raw data (wrap the raw data with StringIO):
 
 ```ruby
 widgets = DBF::Table.new(StringIO.new('raw binary data'))
 ```
 
+Use the block form to close the table automatically, like File.open:
+
+```ruby
+DBF::Table.open('widgets.dbf') do |table|
+  table.each { |record| puts record.name }
+end
+```
+
 Enumerate all records
 
 ```ruby
@@ -287,13 +307,15 @@ table.name = 'my_table_name'
 A small command-line utility called dbf is installed with the gem.
 
     $ dbf -h
-    usage: dbf [-h|-s|-a] filename
+    usage: dbf [-h|-s|-a|-c|-r|-j|-J] filename
       -h = print this message
-      -v = print the version number
+      -v = print the DBF gem version
       -s = print summary information
       -a = create an ActiveRecord::Schema
-      -r = create a Sequel Migration
+      -r = create a Sequel migration
       -c = export as CSV
+      -j = export as a JSON array
+      -J = export as JSON Lines (one record per line)
 
 Create an executable ActiveRecord schema:
 
@@ -307,6 +329,15 @@ Dump all records to a CSV file:
 
     dbf -c books.dbf > books.csv
 
+Dump all records as JSON or JSON Lines:
+
+    dbf -j books.dbf > books.json
+    dbf -J books.dbf > books.jsonl
+
+JSON Lines output is streamed record by record, so it works well for very
+large files and pipelines (for example `dbf -J books.dbf | jq` or importing
+into DuckDB).
+
 ## Reading a Visual Foxpro database (v8, v9)
 
 A special Database::Foxpro class is available to read Visual Foxpro container
@@ -374,25 +405,6 @@ Data type descriptions
 
 ## License
 
-Copyright (c) 2006-2024 Keith Morrison <<keithm@infused.org>>
-
-Permission is hereby granted, free of charge, to any person
-obtaining a copy of this software and associated documentation
-files (the "Software"), to deal in the Software without
-restriction, including without limitation the rights to use,
-copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the
-Software is furnished to do so, subject to the following
-conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
-OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
-HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-OTHER DEALINGS IN THE SOFTWARE.
+Copyright (c) 2006-2026 Keith Morrison <<keithm@infused.org>>
+
+Released under the MIT License. See [LICENSE](LICENSE) for the full text.

data/dbf.gemspec

@@ -15,7 +15,11 @@ Gem::Specification.new do |s|
   s.require_paths = ['lib']
   s.required_ruby_version = '>= 3.3.0'
   s.metadata['rubygems_mfa_required'] = 'true'
+  s.metadata['homepage_uri'] = 'https://github.com/infused/dbf'
   s.metadata['source_code_uri'] = 'https://github.com/infused/dbf'
   s.metadata['changelog_uri'] = 'https://github.com/infused/dbf/blob/main/CHANGELOG.md'
-  s.add_dependency 'csv'
+  s.metadata['bug_tracker_uri'] = 'https://github.com/infused/dbf/issues'
+  s.metadata['documentation_uri'] = 'https://dbf.infused.org'
+  s.metadata['funding_uri'] = 'https://github.com/sponsors/infused'
+  s.add_dependency 'csv', '~> 3.3'
 end

data/lib/dbf/cli.rb

@@ -5,15 +5,61 @@ require 'optparse'
 module DBF
   class CLI
     USAGE = <<~HELP
-      usage: dbf [-h|-s|-a|-c|-r] filename
+      usage: dbf [-h|-s|-a|-c|-r|-j|-J] filename
         -h = print this message
         -v = print the DBF gem version
         -s = print summary information
         -a = create an ActiveRecord::Schema
         -r = create a Sequel migration
         -c = export as CSV
+        -j = export as a JSON array
+        -J = export as JSON Lines (one record per line)
     HELP
 
+    # Bytes a terminal interprets as control or escape sequences. A crafted
+    # DBF can carry these in column names and record values, so they are
+    # replaced before file-derived text reaches an interactive terminal.
+    CONTROL_BYTES = /[\x00-\x1F\x7F]/n
+    # The same, but keeping CR and LF so CSV row separators survive.
+    CONTROL_BYTES_KEEPING_NEWLINES = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/n
+
+    # Replaces terminal control bytes. Substitution happens on a byte copy so
+    # a value whose bytes are invalid in its encoding cannot raise here.
+    #
+    # @param value [Object]
+    # @param pattern [Regexp]
+    # @return [String]
+    def self.sanitize(value, pattern = CONTROL_BYTES)
+      string = value.to_s
+      string.b.gsub(pattern, '?').force_encoding(string.encoding)
+    end
+
+    # Wraps an IO so text written to an interactive terminal is stripped of
+    # control bytes. Redirected or piped output is never wrapped, so exported
+    # data is passed through unaltered.
+    class TerminalFilter
+      def initialize(io)
+        @io = io
+      end
+
+      def <<(data)
+        @io << CLI.sanitize(data, CONTROL_BYTES_KEEPING_NEWLINES)
+        self
+      end
+
+      def write(*data)
+        @io.write(*data.map { |datum| CLI.sanitize(datum, CONTROL_BYTES_KEEPING_NEWLINES) })
+      end
+
+      def method_missing(name, ...) # :nodoc:
+        @io.respond_to?(name) ? @io.send(name, ...) : super
+      end
+
+      def respond_to_missing?(name, include_private = false) # :nodoc:
+        @io.respond_to?(name, include_private) || super
+      end
+    end
+
     def self.run(argv, stdout: $stdout, stderr: $stderr)
       new(argv, stdout: stdout, stderr: stderr).run
     end
@@ -24,8 +70,17 @@ module DBF
       @stderr = stderr
     end
 
+    ACTIONS = {
+      'a' => :print_ar_schema,
+      'r' => :print_sequel_schema,
+      's' => :print_summary,
+      'c' => :print_csv,
+      'j' => :print_json,
+      'J' => :print_jsonl
+    }.freeze
+
     def run
-      params = OptionParser.new.getopts(@argv, 'h', 's', 'a', 'c', 'r', 'v')
+      params = OptionParser.new.getopts(@argv, 'hsacrvjJ')
 
       if params['v']
         print_version
@@ -35,13 +90,8 @@ module DBF
         filename = @argv.shift
         return missing_filename unless filename
 
-        action = %w[a r s c].find { |flag| params[flag] }
-        case action
-        when 'a' then print_ar_schema(filename)
-        when 'r' then print_sequel_schema(filename)
-        when 's' then print_summary(filename)
-        when 'c' then print_csv(filename)
-        end
+        action = ACTIONS.find { |flag, _method| params[flag] }&.last
+        send(action, filename) if action
       end
       0
     rescue DBF::FileNotFoundError => e
@@ -64,16 +114,23 @@ module DBF
       1
     end
 
+    # Always close the table when done: an open handle prevents deleting or
+    # replacing the file on Windows.
+    def with_table(filename, &) = DBF::Table.open(filename, &)
+
     def print_ar_schema(filename)
-      @stdout.puts DBF::Table.new(filename).schema(:activerecord)
+      with_table(filename) { |table| @stdout.puts terminal_safe(table.schema(:activerecord)) }
     end
 
     def print_sequel_schema(filename)
-      @stdout.puts DBF::Table.new(filename).schema(:sequel)
+      with_table(filename) { |table| @stdout.puts terminal_safe(table.schema(:sequel)) }
     end
 
     def print_summary(filename)
-      table = DBF::Table.new(filename)
+      with_table(filename) { |table| write_summary(filename, table) }
+    end
+
+    def write_summary(filename, table)
       @stdout.puts
       @stdout.puts "Database: #{filename}"
       @stdout.puts "Type: (#{table.version}) #{table.version_description}"
@@ -84,12 +141,74 @@ module DBF
       @stdout.puts 'Name             Type       Length     Decimal'
       @stdout.puts '-' * 78
       table.columns.each do |f|
-        @stdout.puts format('%-16s %-10s %-10s %-10s', f.name, f.type, f.length, f.decimal)
+        # Column names and types come from the file. Always replace control
+        # bytes here: they are never valid in a name and would otherwise both
+        # emit escape sequences and break the column alignment below.
+        @stdout.puts format('%-16s %-10s %-10s %-10s', self.class.sanitize(f.name), self.class.sanitize(f.type), f.length, f.decimal)
       end
     end
 
     def print_csv(filename)
-      DBF::Table.new(filename).to_csv(@stdout)
+      with_table(filename) { |table| table.to_csv(interactive? ? TerminalFilter.new(@stdout) : @stdout) }
+    end
+
+    # Streams a JSON array without materializing all records in memory.
+    # JSON string escaping makes the output terminal-safe by construction:
+    # control bytes are emitted as \uXXXX escapes.
+    def print_json(filename)
+      with_table(filename) { |table| write_json(table) }
+    end
+
+    def write_json(table)
+      first = true
+      @stdout.write('[')
+      each_present_record(table) do |record|
+        @stdout.write(first ? "\n" : ",\n")
+        @stdout.write(json_record(record))
+        first = false
+      end
+      @stdout.write("\n]\n")
+    end
+
+    # One JSON object per line (JSON Lines). Combined with chunked record
+    # reading this exports arbitrarily large files in constant memory.
+    def print_jsonl(filename)
+      with_table(filename) { |table| write_jsonl(table) }
+    end
+
+    def write_jsonl(table)
+      each_present_record(table) { |record| @stdout.write("#{json_record(record)}\n") }
+    end
+
+    # Deleted records have no attributes, so JSON export skips them.
+    def each_present_record(table, &)
+      table.each { |record| yield record if record }
+    end
+
+    def json_record(record)
+      JSON.generate(record.attributes.to_h { |key, value| [json_safe(key), json_safe(value)] })
+    end
+
+    # JSON.generate raises on binary or invalidly encoded strings; represent
+    # their bytes instead of raising, mirroring the CSV export behavior.
+    def json_safe(value)
+      return value unless value.is_a?(::String)
+
+      value.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: '?')
+    rescue Encoding::ConverterNotFoundError
+      value.dup.force_encoding(Encoding::UTF_8).scrub('?')
+    end
+
+    # Exported data is only filtered when it is going to a terminal, so
+    # redirecting or piping still produces byte-for-byte the original values.
+    def terminal_safe(text)
+      return text unless interactive?
+
+      self.class.sanitize(text, CONTROL_BYTES_KEEPING_NEWLINES)
+    end
+
+    def interactive?
+      @stdout.respond_to?(:tty?) && @stdout.tty?
     end
   end
 end

data/lib/dbf/column.rb

@@ -2,12 +2,17 @@
 
 module DBF
   class Column
-    class LengthError < StandardError
+    class LengthError < DBF::Error
     end
 
-    class NameError < StandardError
+    class InvalidNameError < DBF::Error
     end
 
+    # Deprecated alias, kept for backward compatibility. It shadowed
+    # ::NameError (without being one), so it was renamed.
+    NameError = InvalidNameError
+    deprecate_constant :NameError
+
     attr_reader :name, :type, :length, :decimal
 
     # rubocop:disable Style/MutableConstant
@@ -38,7 +43,7 @@ module DBF
     def initialize(table, name, type, length, decimal)
       @table = table
       @name = clean(name)
-      @type = type
+      @type = clean_type(type)
       @length = length
       @decimal = decimal
 
@@ -85,6 +90,14 @@ module DBF
       @table.encode_string(value.strip.split("\x00", 2).first || +'')
     end
 
+    # The column type is a single ASCII character. A corrupt file can supply
+    # any byte, which would otherwise stay binary and raise when serialized
+    # (e.g. to JSON), so replace anything unrepresentable.
+    def clean_type(value) # :nodoc:
+      type = value.to_s.dup.force_encoding(Encoding::UTF_8)
+      type.valid_encoding? ? type : type.scrub('?')
+    end
+
     def type_cast_class # :nodoc:
       @type_cast_class ||= begin
         klass = @length == 0 ? ColumnType::Nil : TYPE_CAST_CLASS[type.to_sym]
@@ -97,7 +110,7 @@ module DBF
     end
 
     def validate_name # :nodoc:
-      raise NameError, 'column name cannot be empty' if @name.empty?
+      raise InvalidNameError, 'column name cannot be empty' if @name.empty?
     end
   end
 end

data/lib/dbf/column_builder.rb

@@ -12,7 +12,15 @@ module DBF
       safe_seek do
         @data.seek(@version_config.header_size)
         [].tap do |columns|
-          columns << Column.new(*@version_config.read_column_args(@table, @data)) until end_of_record?
+          until end_of_record?
+            args = @version_config.read_column_args(@table, @data)
+            # A descriptor truncated by EOF is returned as nil, or unpacks to
+            # a nil length; stop rather than constructing an invalid column
+            # (which would crash on nil < 0).
+            break if args.nil? || args[3].nil?
+
+            columns << Column.new(*args)
+          end
         end
       end
     end
@@ -20,7 +28,12 @@ module DBF
     private
 
     def end_of_record?
-      safe_seek { @data.read(1).ord == 13 }
+      safe_seek do
+        byte = @data.read(1)
+        # A truncated file that ends before the 0x0D column terminator marks
+        # the end of the column list rather than crashing on nil.ord.
+        byte.nil? || byte.ord == 13
+      end
     end
 
     def safe_seek

data/lib/dbf/column_type.rb

@@ -20,6 +20,10 @@ module DBF
       end
 
       def decode(raw, &)
+        # A record truncated before this column yields a nil slice; treat it
+        # as blank rather than crashing in the type cast.
+        return blank_value if raw.nil?
+
         if skip_blank? && raw.count(' ') == raw.length
           blank_value
         else
@@ -49,7 +53,8 @@ module DBF
     class Currency < Base
       # @param value [String]
       def type_cast(value)
-        (value.unpack1('q<') / 10_000.0).to_f
+        int = value.unpack1('q<')
+        int && (int / 10_000.0).to_f
       end
     end
 
@@ -64,6 +69,8 @@ module DBF
       # @param value [String]
       def type_cast(value)
         bits = value.unpack1('B*')
+        return nil unless bits && bits.length >= 32
+
         sign_multiplier = bits[0] == '0' ? -1 : 1
         bits[1, 31].to_i(2) * sign_multiplier
       end
@@ -105,7 +112,7 @@ module DBF
       # @param value [String]
       def type_cast(value)
         value.match?(/\d{8}/) && ::Date.strptime(value, '%Y%m%d')
-      rescue StandardError
+      rescue ArgumentError, RangeError, TypeError
         nil
       end
     end
@@ -118,7 +125,7 @@ module DBF
 
         secs = (msecs / 1000).to_i
         ::DateTime.jd(days, (secs / 3600).to_i, (secs / 60).to_i % 60, secs % 60).to_time
-      rescue StandardError
+      rescue ArgumentError, RangeError, TypeError
         nil
       end
     end

data/lib/dbf/database/foxpro.rb

@@ -47,11 +47,25 @@ module DBF
       # @param name [String]
       # @return [String]
       def table_path(name)
-        glob = File.join(@dirname, "#{name}.dbf")
-        path = Dir.glob(glob, File::FNM_CASEFOLD).first
+        name = name.to_s
+        raise DBF::FileNotFoundError, "related table not found: #{name}" if name.empty? || name.include?("\x00")
+
+        # Treat the container-supplied name as an untrusted basename so that
+        # path separators and ".." cannot escape the database directory.
+        # Match case-insensitively by scanning the directory rather than
+        # globbing, so glob metacharacters (`{}`, `*`, `?`, `[]`) in the name
+        # cannot trigger brace-expansion CPU exhaustion.
+        target = "#{File.basename(name)}.dbf"
+        entry = Dir.children(@dirname).find { |child| child.casecmp?(target) }
+        path = entry && File.join(@dirname, entry)
 
         raise DBF::FileNotFoundError, "related table not found: #{name}" unless path && File.exist?(path)
 
+        # Defense in depth: confirm the resolved file really is inside the
+        # database directory before opening it.
+        contained = File.realpath(path).start_with?("#{File.realpath(@dirname)}#{File::SEPARATOR}")
+        raise DBF::FileNotFoundError, "related table not found: #{name}" unless contained
+
         path
       end
 
@@ -100,12 +114,10 @@ module DBF
       end
 
       def build_columns # :nodoc:
-        columns = super
-
         # modify the column definitions to use the long names as the
         # columnname property is readonly, recreate the column definitions
-        columns.map do |column|
-          long_name = long_names[columns.index(column)]
+        super.each_with_index.map do |column, index|
+          long_name = long_names[index] || column.name
           Column.new(self, long_name, column.type, column.length, column.decimal)
         end
       end

data/lib/dbf/errors.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module DBF
+  # Base class for all errors raised by the DBF library, so callers can
+  # rescue DBF::Error to catch anything the library raises.
+  class Error < StandardError
+  end
+
+  class FileNotFoundError < Error
+  end
+
+  class NoColumnsDefined < Error
+  end
+end

data/lib/dbf/file_handler.rb

@@ -11,7 +11,12 @@ module DBF
       when String
         File.open(data, 'rb')
       else
-        raise ArgumentError, 'data must be a file path or StringIO object'
+        raise ArgumentError, 'data must be a file path or an IO-like object responding to #read and #seek' unless data.respond_to?(:read) && data.respond_to?(:seek)
+
+        # DBF is a binary format; a File opened in text mode would corrupt
+        # reads on Windows.
+        data.binmode if data.respond_to?(:binmode)
+        data
       end
     rescue Errno::ENOENT
       raise DBF::FileNotFoundError, "file not found: #{data}"
@@ -19,17 +24,23 @@ module DBF
 
     def open_memo(data, memo, memo_class, version)
       if memo
-        meth = memo.is_a?(StringIO) ? :new : :open
+        meth = memo.is_a?(String) ? :open : :new
         memo_class.send(meth, memo, version)
-      elsif !data.is_a?(StringIO)
-        path = Dir.glob(memo_search_path(data)).first
-        path && memo_class.open(path, version)
+      elsif (path = data_path(data))
+        found = Dir.glob(memo_search_path(path)).first
+        found && memo_class.open(found, version)
       end
     end
 
-    def memo_search_path(io)
-      dirname = File.dirname(io)
-      basename = File.basename(io, '.*')
+    def data_path(data)
+      return data if data.is_a?(String)
+
+      data.path if data.respond_to?(:path)
+    end
+
+    def memo_search_path(path)
+      dirname = File.dirname(path)
+      basename = File.basename(path, '.*')
       "#{dirname}/#{basename}*.{fpt,FPT,dbt,DBT}"
     end
   end

data/lib/dbf/header.rb

@@ -5,6 +5,9 @@ module DBF
     attr_reader :version, :record_count, :header_length, :record_length, :encoding_key, :encoding
 
     def initialize(data)
+      # Pad a nil or truncated header read so unpacking a short file yields
+      # empty values instead of raising.
+      data = data.to_s.b.ljust(VersionConfig::DBASE3_HEADER_SIZE, "\x00")
       @version = data.unpack1('H2')
       @encoding_key = nil
       @encoding = nil

data/lib/dbf/memo/dbase3.rb

@@ -7,7 +7,12 @@ module DBF
         data.seek offset(start_block)
         memo_string = +''
         loop do
-          block = data.read(BLOCK_SIZE).gsub(/(\000|\032)/, '')
+          block = data.read(BLOCK_SIZE)
+          # A start block past EOF yields nil; return what we have rather
+          # than crashing on nil.gsub.
+          break if block.nil?
+
+          block = block.gsub(/(\000|\032)/, '')
           memo_string << block
           break if block.size < BLOCK_SIZE
         end

data/lib/dbf/memo/dbase4.rb

@@ -5,7 +5,21 @@ module DBF
     class Dbase4 < Base
       def build_memo(start_block) # :nodoc:
         data.seek offset(start_block)
-        data.read(data.read(BLOCK_HEADER_SIZE).unpack1('x4L'))
+
+        # A start block past EOF yields a nil/short header; return nil rather
+        # than crashing on nil.unpack1.
+        header = data.read(BLOCK_HEADER_SIZE)
+        return nil unless header && header.bytesize == BLOCK_HEADER_SIZE
+
+        length = header.unpack1('x4L')
+
+        # Bound the read by the bytes remaining so a crafted 32-bit length
+        # field cannot force a ~4 GiB allocation from a small memo file.
+        remaining = data.size - data.pos
+        length = remaining if length > remaining
+        return nil if length <= 0
+
+        data.read(length)
       end
     end
   end

data/lib/dbf/memo/foxpro.rb

@@ -5,35 +5,40 @@ module DBF
     class Foxpro < Base
       FPT_HEADER_SIZE = 512
 
-      def initialize(data, version)
-        @data = data
-        super
-      end
-
       def build_memo(start_block) # :nodoc:
-        @data.seek offset(start_block)
-        memo_type, memo_size, memo_string = @data.read(block_size).unpack('NNa*')
-        return nil unless memo_type == 1 && memo_size > 0
+        data.seek offset(start_block)
+        block = data.read(block_size)
+        return nil unless block
+
+        # memo_size is nil when the block header is truncated (< 8 bytes)
+        memo_type, memo_size, memo_string = block.unpack('NNa*')
+        return nil unless memo_type == 1 && memo_size.to_i.positive?
 
         read_memo_content(memo_string, memo_size)
-      rescue StandardError
+      rescue IOError, SystemCallError, RangeError
         nil
       end
 
       private
 
       def read_memo_content(memo_string, memo_size) # :nodoc:
-        if memo_size > block_content_size
-          memo_string << @data.read(content_size(memo_size))
-        else
-          memo_string[0, memo_size]
-        end
+        return memo_string[0, memo_size] unless memo_size > block_content_size
+
+        # Bound the read by the bytes remaining so a crafted 32-bit memo_size
+        # cannot force a ~4 GiB allocation from a small memo file.
+        length = content_size(memo_size)
+        remaining = data.size - data.pos
+        length = remaining if length > remaining
+        memo_string << data.read(length) if length.positive?
+        memo_string
       end
 
       def block_size # :nodoc:
         @block_size ||= begin
-          @data.rewind
-          @data.read(FPT_HEADER_SIZE).unpack1('x6n') || 0
+          data.rewind
+          header = data.read(FPT_HEADER_SIZE)
+          # A header shorter than 8 bytes cannot contain the block size field
+          header && header.bytesize >= 8 ? header.unpack1('x6n') : 0
         end
       end
     end

data/lib/dbf/record.rb

@@ -20,9 +20,7 @@ module DBF
     # @param [DBF::Record] other
     # @return [Boolean]
     def ==(other)
-      attributes == other.attributes
-    rescue NoMethodError
-      false
+      other.respond_to?(:attributes) && attributes == other.attributes
     end
 
     # Reads attributes by column name
@@ -83,7 +81,9 @@ module DBF
 
     def decode_memo_value(raw) # :nodoc:
       memo = @context.memo
-      return nil unless memo
+      # A record truncated before the memo column yields a nil pointer; skip
+      # decoding rather than crashing on nil.unpack1.
+      return nil unless memo && raw
 
       version = @context.version
       raw = raw.unpack1('V') if version == '30' || version == '31'

data/lib/dbf/record_context.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
 module DBF
-  RecordContext = Struct.new(:columns, :version, :memo, :column_offsets, keyword_init: true)
+  # Immutable per-table state shared by every record during decoding
+  RecordContext = Data.define(:columns, :version, :memo, :column_offsets)
 end

data/lib/dbf/record_iterator.rb

@@ -2,34 +2,75 @@
 
 module DBF
   class RecordIterator
-    def initialize(data, context, header_length, record_length, record_count)
+    # Records are read in chunks of whole records totalling roughly this many
+    # bytes, so enumerating a multi-gigabyte file (for example a shapefile
+    # sidecar) needs only chunk-sized memory instead of the entire record
+    # section at once.
+    CHUNK_SIZE = 4 * 1024 * 1024
+
+    def initialize(data, context, header_length, record_length, record_count, chunk_size: CHUNK_SIZE)
       @data = data
       @context = context
       @header_length = header_length
       @record_length = record_length
       @record_count = record_count
+      @chunk_size = chunk_size
+    end
+
+    def each(&)
+      return enum_for(:each) unless block_given?
+
+      # A record_length of 0 from a crafted header cannot drive an unbounded
+      # loop: capacity is 0 and enumeration ends immediately.
+      remaining = record_capacity
+      @data.seek(@header_length)
+
+      while remaining.positive?
+        wanted = [per_chunk, remaining].min
+        buffer = @data.read(wanted * @record_length)
+        break unless buffer
+
+        whole_records = buffer.bytesize / @record_length
+        break if whole_records.zero?
+
+        yield_chunk(buffer, whole_records, &)
+        remaining -= whole_records
+
+        # A short read means the file ended earlier than the header promised
+        break if whole_records < wanted
+      end
     end
 
-    def each
-      buf = read_buffer
-      return unless buf
+    private
+
+    # Whole records per read; at least one so a record larger than the chunk
+    # size still makes progress. Only called when record_length is positive.
+    def per_chunk
+      @per_chunk ||= [@chunk_size / @record_length, 1].max
+    end
 
+    def yield_chunk(buffer, count)
       pos = 0
-      @record_count.times do
-        if buf.getbyte(pos) == 0x2A
+      count.times do
+        if buffer.getbyte(pos) == 0x2A
           yield nil
         else
-          yield Record.new(buf, @context, pos + 1)
+          yield Record.new(buffer, @context, pos + 1)
         end
         pos += @record_length
       end
     end
 
-    private
+    # Bound enumeration by the bytes actually available so a crafted header
+    # (huge record_length * record_count) cannot force reads past the real
+    # file size, while record_count still caps a file with trailing garbage.
+    def record_capacity
+      return 0 unless @record_length.positive?
 
-    def read_buffer
-      @data.seek(@header_length)
-      @data.read(@record_length * @record_count)
+      available = @data.size - @header_length
+      return 0 if available.negative?
+
+      [@record_count, available / @record_length].min
     end
   end
 end

data/lib/dbf/schema.rb

@@ -43,10 +43,9 @@ module DBF
     # @param table_only [Boolean]
     # @return [String]
     def schema(format = :activerecord, table_only: false)
-      schema_method_name = schema_name(format)
-      send(schema_method_name, table_only: table_only)
-    rescue NameError
-      raise ArgumentError, ":#{format} is not a valid schema. Valid schemas are: #{FORMATS.join(', ')}."
+      raise ArgumentError, ":#{format} is not a valid schema. Valid schemas are: #{FORMATS.join(', ')}." unless FORMATS.include?(format.to_s.to_sym)
+
+      send(schema_name(format), table_only: table_only)
     end
 
     def schema_name(format) # :nodoc:
@@ -55,7 +54,7 @@ module DBF
 
     def activerecord_schema(*) # :nodoc:
       output = +"ActiveRecord::Schema.define do\n"
-      output << "  create_table \"#{name}\" do |t|\n"
+      output << "  create_table #{name.to_s.inspect} do |t|\n"
       columns.each do |column|
         output << "    t.column #{activerecord_schema_definition(column)}"
       end
@@ -66,7 +65,7 @@ module DBF
     def sequel_schema(table_only: false) # :nodoc:
       output = +''
       output << "Sequel.migration do\n  change do\n " unless table_only
-      output << "    create_table(:#{name}) do\n"
+      output << "    create_table(#{name.to_s.to_sym.inspect}) do\n"
       columns.each do |column|
         output << "      column #{sequel_schema_definition(column)}"
       end
@@ -84,7 +83,7 @@ module DBF
     # @param column [DBF::Column]
     # @return [String]
     def activerecord_schema_definition(column)
-      "\"#{column.underscored_name}\", #{schema_data_type(column, :activerecord)}\n"
+      "#{column.underscored_name.inspect}, #{schema_data_type(column, :activerecord)}\n"
     end
 
     # Sequel schema definition
@@ -92,7 +91,7 @@ module DBF
     # @param column [DBF::Column]
     # @return [String]
     def sequel_schema_definition(column)
-      ":#{column.underscored_name}, #{schema_data_type(column, :sequel)}\n"
+      "#{column.underscored_name.to_sym.inspect}, #{schema_data_type(column, :sequel)}\n"
     end
 
     def schema_data_type(column, format = :activerecord) # :nodoc:

data/lib/dbf/table.rb

@@ -1,11 +1,9 @@
 # frozen_string_literal: true
 
 module DBF
-  class FileNotFoundError < StandardError
-  end
-
-  class NoColumnsDefined < StandardError
-  end
+  # Leading bytes that make a spreadsheet treat a CSV cell as a formula:
+  # "=", "+", "-", "@", tab, and carriage return.
+  CSV_FORMULA_TRIGGERS = [0x3D, 0x2B, 0x2D, 0x40, 0x09, 0x0D].freeze
 
   # DBF::Table is the primary interface to a single DBF file and provides
   # methods for enumerating and searching the records.
@@ -33,6 +31,9 @@ module DBF
     #   # working with a dbf in memory
     #   table = DBF::Table.new StringIO.new(dbf_data)
     #
+    #   # working with an open IO object
+    #   table = DBF::Table.new File.open('data.dbf', 'rb')
+    #
     #   # working with a dbf and memo in memory
     #   table = DBF::Table.new StringIO.new(dbf_data), StringIO.new(memo_data)
     #
@@ -40,8 +41,28 @@ module DBF
     #   table = DBF::Table.new 'data.dbf', nil, 'cp437'
     #   table = DBF::Table.new 'data.dbf', 'memo.dbt', Encoding::US_ASCII
     #
-    # @param data [String, StringIO] data Path to the dbf file or a StringIO object
-    # @param memo [optional String, StringIO] memo Path to the memo file or a StringIO object
+    # Opens a table like .new, but when given a block, yields the table,
+    # closes it when the block returns, and returns the block's value —
+    # the same contract as File.open.
+    #
+    #   DBF::Table.open('data.dbf') do |table|
+    #     table.each { |record| ... }
+    #   end
+    #
+    # Takes the same arguments as .new. Without a block, equivalent to .new.
+    def self.open(data, memo = nil, encoding = nil, name: nil)
+      table = new(data, memo, encoding, name: name)
+      return table unless block_given?
+
+      begin
+        yield table
+      ensure
+        table.close
+      end
+    end
+
+    # @param data [String, StringIO, IO] data Path to the dbf file or an IO-like object
+    # @param memo [optional String, StringIO, IO] memo Path to the memo file or an IO-like object
     # @param encoding [optional String, Encoding] encoding Name of the encoding or an Encoding object
     def initialize(data, memo = nil, encoding = nil, name: nil)
       @data = FileHandler.open_data(data)
@@ -106,7 +127,7 @@ module DBF
 
     # @return [String]
     def filename
-      File.basename(@data.path) if @data.is_a?(File)
+      File.basename(@data.path) if @data.respond_to?(:path)
     end
 
     # @return [TrueClass, FalseClass]
@@ -132,6 +153,10 @@ module DBF
       return nil if deleted_record?
 
       record_data = @data.read(record_length)
+      # A file that ends immediately after the delete flag has no record body;
+      # treat it as absent rather than building a Record over nil data.
+      return nil unless record_data
+
       DBF::Record.new(record_data, record_context)
     end
 
@@ -142,14 +167,11 @@ module DBF
     #
     # @param [optional String, IO] path_or_io String path, IO-like object, or nil for STDOUT
     def to_csv(path_or_io = nil)
-      io = case path_or_io
-      when nil then $stdout
-      when String then File.open(path_or_io, 'w')
-      else path_or_io
+      if path_or_io.is_a?(String)
+        File.open(path_or_io, 'w') { |file| write_csv(file) }
+      else
+        write_csv(path_or_io || $stdout)
       end
-      csv = CSV.new(io, force_quotes: true)
-      csv << column_names
-      each { |record| csv << record.to_a }
     end
 
     # Human readable version description
@@ -176,6 +198,37 @@ module DBF
 
     private
 
+    def write_csv(io) # :nodoc:
+      csv = CSV.new(io, force_quotes: true)
+      csv << column_names.map { |name| csv_safe_value(name) }
+      each { |record| csv << record.to_a.map { |value| csv_safe_value(value) } }
+    end
+
+    # Neutralizes spreadsheet formula injection (CWE-1236) on CSV export by
+    # prefixing a single quote to string cells that begin with a formula
+    # trigger character. Non-string values (numbers, dates, booleans) are
+    # returned unchanged. The leading byte is compared numerically so that a
+    # value whose bytes are invalid in its encoding cannot raise here.
+    def csv_safe_value(value) # :nodoc:
+      return value unless value.is_a?(::String)
+
+      value = csv_compatible(value)
+      return value unless CSV_FORMULA_TRIGGERS.include?(value.getbyte(0))
+
+      quote = +"'"
+      quote.force_encoding(value.encoding) + value
+    end
+
+    # A row is written as a single string, so a binary (General/OLE) or
+    # invalidly encoded cell would raise Encoding::CompatibilityError when
+    # combined with text cells. Represent those bytes instead of raising.
+    def csv_compatible(value) # :nodoc:
+      return value if value.ascii_only?
+      return value if value.valid_encoding? && value.encoding != Encoding::BINARY
+
+      value.dup.force_encoding(Encoding::UTF_8).scrub('?')
+    end
+
     def version_config
       @version_config ||= VersionConfig.new(version)
     end

data/lib/dbf/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DBF
-  VERSION = '5.3.0'
+  VERSION = '5.5.0'
 end

data/lib/dbf/version_config.rb

@@ -68,11 +68,22 @@ module DBF
       end
     end
 
+    # Returns the Column.new arguments for the next column descriptor, or nil
+    # when the file ends mid-descriptor. Unpacking a short descriptor would
+    # otherwise raise ArgumentError ("x outside of string").
     def read_column_args(table, io)
+      size, format, defaults = column_layout
+      data = io.read(size)
+      return nil unless data && data.bytesize == size
+
+      [table, *data.unpack(format), *defaults]
+    end
+
+    def column_layout # :nodoc:
       case version
-      when '02' then [table, *io.read(header_size * 2).unpack('A11 a C'), 0]
-      when '04', '8c' then [table, *io.read(48).unpack('A32 a C C x13')]
-      else [table, *io.read(header_size).unpack('A11 a x4 C2')]
+      when '02' then [header_size * 2, 'A11 a C', [0]]
+      when '04', '8c' then [48, 'A32 a C C x13', []]
+      else [header_size, 'A11 a x4 C2', []]
       end
     end
   end

data/lib/dbf.rb

@@ -7,6 +7,7 @@ require 'json'
 require 'time'
 
 require 'dbf/version'
+require 'dbf/errors'
 require 'dbf/schema'
 require 'dbf/find'
 require 'dbf/record'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dbf
 version: !ruby/object:Gem::Version
-  version: 5.3.0
+  version: 5.5.0
 platform: ruby
 authors:
 - Keith Morrison
@@ -13,16 +13,16 @@ dependencies:
   name: csv
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '3.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '3.3'
 description: A small fast library for reading dBase, xBase, Clipper and FoxPro database
   files.
 email: keithm@infused.org
@@ -44,6 +44,7 @@ files:
 - lib/dbf/database/foxpro.rb
 - lib/dbf/encoder.rb
 - lib/dbf/encodings.rb
+- lib/dbf/errors.rb
 - lib/dbf/file_handler.rb
 - lib/dbf/find.rb
 - lib/dbf/header.rb
@@ -63,8 +64,12 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
+  homepage_uri: https://github.com/infused/dbf
   source_code_uri: https://github.com/infused/dbf
   changelog_uri: https://github.com/infused/dbf/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/infused/dbf/issues
+  documentation_uri: https://dbf.infused.org
+  funding_uri: https://github.com/sponsors/infused
 rdoc_options: []
 require_paths:
 - lib
@@ -79,7 +84,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Read xBase files
 test_files: []