dbf 5.4.0 → 5.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f296a6fc75892231410af21b2ee94490666f740f425f671078b5c28ded1e2977
-  data.tar.gz: eed4dfd84582cdf9c8e125ca2ddb1e882ebe75147321469db26166f7777a1ea1
+  metadata.gz: e9d4250b08de3a7a96f24fff3f55e5457524288951b9d0ca8ffc8127aae2c790
+  data.tar.gz: 78d946bd48943b8d6527aac3e982017133480d8263bc5025d2c8d3a85407185e
 SHA512:
-  metadata.gz: 578f0f6cc7c88a205c38fd2ef93af2d8e5c924483018af4b96fb349dd12f40386c13547dfc67cd6fbdd47e191a0d04ef46bf0e1c38f9baec6057197661cd6945
-  data.tar.gz: 6960aba5a5b253cc6041c0822a504714ab5a511fee4ea1ff84f43cde10c8cf7db4d74d46f84e670d49f3a4d7110525a3196ea2f76cbcc37174a657e56a755fae
+  metadata.gz: b2e613d19239abb6df53c941c952da129bb77ff6cfbcc7b91cdeac10d9f8ad28724102c20ad6f53533959e0adc1f0f159ffadd0811f4997b623633d5c9fa2edf
+  data.tar.gz: 5964675e521e61be0d3da141c642cfc13c0e71b232ae2a4070053d0764b3e3ee1ca653a786ef70f3001b98f24b4eaf05eee9c4a81a86fd14b2506a939ea2eba3

data/CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## 5.6.0
+
+### Fixed
+
+- Security (CWE-200, CWE-400): memo auto-discovery now looks only for a memo with exactly the table's basename (`.fpt`/`.dbt`, any case), by scanning the directory rather than globbing. Previously `1.dbf` could pick up `12.fpt`, and glob metacharacters in an uploaded filename were expanded
+- Security (CWE-400): column parsing stops at `header_length` and drops columns that do not fit within `record_length`, so a small crafted file can no longer declare thousands of overlapping columns and cause quadratic decoding work and output
+- Security (CWE-838): string values that need no transcoding have invalid bytes replaced, as transcoded values already did, so they no longer raise in JSON generation, HTML escaping, or database inserts
+- Security (CWE-248): a DateTime (`T`) column narrower than 8 bytes decodes to nil instead of raising `NoMethodError`
+- Security (CWE-915): column names (and Visual FoxPro `.dbc` table names) such as `to_str`, `to_ary`, `to_hash`, `to_proc`, or `to_partial_path` are no longer exposed as methods, so a crafted file cannot hijack implicit conversions or Rails rendering; those columns stay readable via `#[]` and `#attributes`
+- Security (CWE-129): `Table#record` returns nil for a negative index instead of reading header bytes as a record or raising `Errno::EINVAL`
+- Security (CWE-150): CLI terminal output also replaces UTF-8 encoded C1 control characters (U+0080–U+009F, e.g. the single-character CSI U+009B)
+- Security (CWE-400): a table declares no more columns than its records have bytes, so zero-length columns can no longer bypass the column bound (an 84 KB file previously produced 2,000 nil cells per one-byte record: a 120 MB CSV and 34 s of work)
+- Security (CWE-248): a dBase III/IV memo pointer too large to seek to decodes to nil instead of raising `RangeError`
+- Tables with the Macintosh Central European language driver (`0x97`) decode through a vendored code page table instead of raising `Encoding::ConverterNotFoundError`, since Ruby has no converter for `macCentEuro`
+- dBase III memos end at the `0x1A` terminator; bytes left over after it in the same block are no longer appended to the memo
+- Visual FoxPro long column names from a `.dbc` container are no longer decoded a second time with the table's code page, which garbled non-ASCII names (`Café` became `Café`)
+- Security (CWE-248): `Table.new` raises only `DBF::Error` subclasses for a bad path or encoding, so rescuing `DBF::Error` is enough. A directory or unreadable file (data or memo) raises the new `DBF::FileAccessError` instead of `Errno::EISDIR`/`Errno::EACCES`. A missing memo path, or a path containing a null byte, raises `DBF::FileNotFoundError` instead of `Errno::ENOENT`/`ArgumentError`. An unknown encoding, or one Ruby cannot transcode such as UTF-7, raises the new `DBF::UnsupportedEncodingError` when the table is opened, rather than `ArgumentError` or `Encoding::ConverterNotFoundError` on the first read. The data file is closed if its memo cannot be opened
+- Security (CWE-209): `DBF::FileNotFoundError` and `DBF::FileAccessError` messages name only the file (`file not found: data.dbf`), not its directory, so an app that shows error messages to users does not reveal server paths. The full path is available as `#path`. Both now inherit from the new `DBF::FileError`
+- The `dbf` command reports a file that cannot be opened (such as a directory) as an error and exits 1, instead of printing a stack trace
+
+### Changed
+
+- Code that rescued `ArgumentError`, `Errno::*` or `Encoding::ConverterNotFoundError` from `Table.new` should rescue `DBF::Error` (or the specific subclasses above) instead. Passing something other than a path or IO still raises `ArgumentError`
+- File error messages no longer include the directory (`file not found: data.dbf` rather than `file not found: /srv/uploads/data.dbf`). Use `DBF::FileError#path` for the full path
+
+### Added
+
+- Security (CWE-400): optional `max_memo_size:` for `DBF::Table.new`, `DBF::Table.open` and `DBF::Database::Foxpro.new`. Each memo is cut off after that many bytes, and no more than that is read from the memo file, so a small table whose records all point at one large (or unterminated) memo can no longer produce output far larger than the upload. Memos are read in full by default
+- `rake fuzz`: coverage-guided mutation fuzzer for the read path (`spec/fuzz/fuzz.rb`), also run as a non-blocking CI job
+- A warning when column descriptors are ignored because they do not fit within the header length or record length, so a file written with wrong length fields no longer loses columns silently. The warning holds no text from the file, and is silenced when `$VERBOSE` is nil
+- README: "Processing untrusted files" section with guidance for accepting DBF uploads, including how to strip Unicode bidirectional controls and zero-width characters, which the library passes through
+
+## 5.5.0
+
+### Added
+
+- `DBF::Table.new` accepts any IO-like object responding to `#read` and `#seek` (`File`, `Tempfile`, …) in addition to a path or `StringIO`, matching what the README already documented; IO inputs are switched to binary mode, and memo auto-discovery works from the IO's path when it has one
+- `DBF::Error` base class: all library errors (`FileNotFoundError`, `NoColumnsDefined`, `Column::LengthError`, `Column::InvalidNameError`) now inherit from it, so callers can `rescue DBF::Error` to catch anything the library raises
+- `Table#filename` now works for any IO input with a path, not only `File`
+- `DBF::Table.open`: same arguments as `.new`, but the block form yields the table, closes it when the block returns, and returns the block's value — the same contract as `File.open`
+- CI: lint job running RuboCop and Reek on every push and pull request
+- CI: test on Windows and macOS (Ruby 3.4) in addition to Linux, since much real-world DBF data originates on Windows/FoxPro systems
+- CI: observe-only (non-blocking) test jobs for JRuby, TruffleRuby, and Ruby head
+- CI: enforce a 99% minimum test coverage floor via SimpleCov
+- Docs site (dbf.infused.org): YARD docs are now built and deployed by CI instead of being committed to the repository; the Pages workflow's deprecated v2/v3 actions (whose artifact backend was shut down in early 2025) are updated to current versions, repairing the broken deploy
+- Dependabot updates for GitHub Actions and gems (weekly), a security policy (SECURITY.md) with private vulnerability reporting, and contributor documentation (CONTRIBUTING.md)
+- Automated releases: pushing a `vX.Y.Z` tag now builds and publishes the gem to RubyGems.org from CI via Trusted Publishing (OIDC) — no long-lived API key. `bundler/gem_tasks` is loaded in the Rakefile, providing `rake build` / `rake release`. Git tags resume at v5.4.0; versions 4.0.0–5.3.0 were released without tags
+- Ractor safety: all library constants are verified Ractor-shareable and reading/exporting tables inside non-main Ractors is covered by specs
+- CLI: `-j` exports records as a JSON array and `-J` as JSON Lines (one record per line, streamed in constant memory); deleted records are skipped, control bytes are escaped by JSON itself, and binary cells are scrubbed instead of raising
+
+### Fixed
+
+- `Table#to_csv(path)` closes the file it opens, so the CSV is fully flushed to disk when the method returns (previously the data could stay buffered until garbage collection)
+- Visual FoxPro: a `.dbc` container supplying fewer long names than the table has columns no longer crashes column building; missing long names fall back to the table's own column names. Column rebuilding is also no longer O(n²)
+- `Table#schema` validates the format against the documented list up front; a `NoMethodError` raised inside a valid schema generator is no longer misreported as "not a valid schema"
+- FoxPro memo files shorter than their 512-byte header no longer crash memo reads (they return nil like other truncations)
+- RuboCop config: restore the default `vendor/**/*` exclusion (overriding `Exclude` replaces the defaults), fixing a CI lint crash where RuboCop descended into cached vendored gems and tried to load plugins from their configs
+- CLI: close the table when finished, so the DBF file can be deleted or replaced immediately afterwards on Windows (an open handle blocks deletion there)
+
+### Removed
+
+- CodeClimate config and README badges: the service is sunset, and coverage is now enforced directly in CI
+
+### Changed
+
+- Streaming reads: `Table#each` now reads records in 4 MB chunks of whole records instead of loading the entire record section into memory, so enumerating multi-gigabyte files (for example shapefile `.dbf` sidecars) uses bounded memory. On a 190 MB file, peak process memory drops from ~222 MB to ~35 MB with identical results. No API change; all malformed-file bounds are preserved
+- Internal: `DBF::RecordContext` is now an immutable `Data` class instead of a `Struct`
+- Internal: remove a redundant `Memo::Foxpro#initialize` and the duplicate `Header::HEADER_SIZE` constant (now sourced from `VersionConfig`)
+- README: replace the stack of version-support notes with a compatibility table, point API docs at dbf.infused.org, and refer to LICENSE instead of inlining the full MIT text; copyright years updated through 2026
+- Gemspec: add `homepage_uri`, `bug_tracker_uri`, `documentation_uri`, and `funding_uri` metadata (shown on the rubygems.org sidebar), and constrain the `csv` runtime dependency to `~> 3.3`
+- `DBF::Column::NameError` is renamed to `DBF::Column::InvalidNameError` (it shadowed Ruby's `::NameError` without being one); the old constant remains as a deprecated alias
+- Rescues in date/datetime decoding and FoxPro memo reads are narrowed to the specific expected errors, so genuine programmer errors surface instead of silently returning nil
+- Declare `reek` and `simplecov` as direct development dependencies instead of relying on rubycritic's transitive dependencies
+- Restrict `debug` and `ruby-lsp` to MRI so `bundle install` succeeds on JRuby/TruffleRuby
+- Test matrix no longer fails fast, and a Ruby head regression no longer fails the build
+- Update pinned `ruby/setup-ruby` action to v1.321.0
+
 ## 5.4.0
 
 - CLI: replace terminal control bytes in file-derived output so a crafted DBF cannot emit escape sequences to an interactive terminal; CSV and schema output are only filtered when writing to a terminal, so redirected exports are unchanged

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2006-2024 Keith Morrison <keithm@infused.org>
+Copyright (c) 2006-2026 Keith Morrison <keithm@infused.org>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -2,36 +2,37 @@
 
 [![Version](https://img.shields.io/gem/v/dbf.svg?style=flat)](https://rubygems.org/gems/dbf)
 [![Build Status](https://github.com/infused/dbf/actions/workflows/build.yml/badge.svg)](https://github.com/infused/dbf/actions/workflows/build.yml)
-[![Code Quality](https://img.shields.io/codeclimate/maintainability/infused/dbf.svg?style=flat)](https://codeclimate.com/github/infused/dbf)
-[![Code Coverage](https://img.shields.io/codeclimate/c/infused/dbf.svg?style=flat)](https://codeclimate.com/github/infused/dbf)
 [![Total Downloads](https://img.shields.io/gem/dt/dbf.svg)](https://rubygems.org/gems/dbf/)
 [![License](https://img.shields.io/github/license/infused/dbf.svg)](https://github.com/infused/dbf)
 
 DBF is a small, fast Ruby library for reading dBase, xBase, Clipper, and FoxPro database files.
 
 * Project page: <https://github.com/infused/dbf>
-* API Documentation: <https://rdoc.info/gems/dbf>
+* API Documentation: <https://dbf.infused.org>
 * Report bugs: <https://github.com/infused/dbf/issues>
 * Questions: Email <mailto:keithm@infused.org> and put DBF somewhere in the
   subject line
 * Change log: <https://github.com/infused/dbf/blob/main/CHANGELOG.md>
 
-NOTE: Beginning with version 5.2 we have dropped support for Ruby 3.2 and earlier.
-
-NOTE: Beginning with version 4.3 we have dropped support for Ruby 3.0 and earlier.
-
-NOTE: Beginning with version 4 we have dropped support for Ruby 2.0, 2.1, 2.2, and 2.3. If you need support for these older Rubies,
-please use 3.0.x (<https://github.com/infused/dbf/tree/3_stable>)
-
-NOTE: Beginning with version 3 we have dropped support for Ruby 1.8 and 1.9. If you need support for older Rubies,
-please use 2.0.x (<https://github.com/infused/dbf/tree/2_stable>)
-
 ## Compatibility
 
 DBF is tested to work with the following versions of Ruby:
 
 * Ruby 3.3.x, 3.4.x, 4.0.x
 
+Older Rubies are supported by older DBF release lines:
+
+| DBF version | Ruby support |
+| ----------- | ------------ |
+| 5.2+        | 3.3+         |
+| 4.3 – 5.1   | 3.1+         |
+| 4.0 – 4.2   | 2.4+         |
+| 3.x ([3_stable](https://github.com/infused/dbf/tree/3_stable)) | 2.0 – 2.3 |
+| 2.x ([2_stable](https://github.com/infused/dbf/tree/2_stable)) | 1.8 – 1.9 |
+
+DBF is Ractor-friendly: all library constants are deeply frozen, so tables
+can be opened, enumerated, and exported inside non-main Ractors.
+
 ## Installation
 
 Install the gem manually:
@@ -58,16 +59,35 @@ widgets = DBF::Table.new("widgets.dbf")
 Open a DBF file using an IO object:
 
 ```ruby
-data = File.open('widgets.dbf')
+data = File.open('widgets.dbf', 'rb')
 widgets = DBF::Table.new(data)
 ```
 
+All errors raised by the library inherit from DBF::Error, so you can rescue
+the library as a unit:
+
+```ruby
+begin
+  widgets = DBF::Table.new("widgets.dbf")
+rescue DBF::Error => e
+  puts "Unable to read DBF file: #{e.message}"
+end
+```
+
 Open a DBF by passing in raw data (wrap the raw data with StringIO):
 
 ```ruby
 widgets = DBF::Table.new(StringIO.new('raw binary data'))
 ```
 
+Use the block form to close the table automatically, like File.open:
+
+```ruby
+DBF::Table.open('widgets.dbf') do |table|
+  table.each { |record| puts record.name }
+end
+```
+
 Enumerate all records
 
 ```ruby
@@ -287,13 +307,15 @@ table.name = 'my_table_name'
 A small command-line utility called dbf is installed with the gem.
 
     $ dbf -h
-    usage: dbf [-h|-s|-a] filename
+    usage: dbf [-h|-s|-a|-c|-r|-j|-J] filename
       -h = print this message
-      -v = print the version number
+      -v = print the DBF gem version
       -s = print summary information
       -a = create an ActiveRecord::Schema
-      -r = create a Sequel Migration
+      -r = create a Sequel migration
       -c = export as CSV
+      -j = export as a JSON array
+      -J = export as JSON Lines (one record per line)
 
 Create an executable ActiveRecord schema:
 
@@ -307,6 +329,15 @@ Dump all records to a CSV file:
 
     dbf -c books.dbf > books.csv
 
+Dump all records as JSON or JSON Lines:
+
+    dbf -j books.dbf > books.json
+    dbf -J books.dbf > books.jsonl
+
+JSON Lines output is streamed record by record, so it works well for very
+large files and pipelines (for example `dbf -J books.dbf | jq` or importing
+into DuckDB).
+
 ## Reading a Visual Foxpro database (v8, v9)
 
 A special Database::Foxpro class is available to read Visual Foxpro container
@@ -367,6 +398,46 @@ Data type descriptions
 * O = Double
 * + = Autoincrement
 
+## Processing untrusted files
+
+The parser is hardened against malformed files: crafted headers cannot force
+huge allocations, unbounded loops, path traversal, or crashes from truncated
+data. If you accept DBF uploads (for example in a web application), also:
+
+* Treat every column name and value as untrusted text. HTML-escape it before
+  rendering it, and escape JSON before embedding it in a `<script>` tag.
+* Pass the upload as a `StringIO` (with an explicit memo `StringIO` if there is
+  one) rather than as a path, so memo files are never looked up in a shared
+  upload directory.
+* Limit upload size and processing time. Many records can point at the same
+  large memo, so exported output can be far larger than the uploaded files.
+  Pass `max_memo_size:` to cut off each memo after that many bytes:
+
+  ```ruby
+  DBF::Table.new(upload, memo_upload, max_memo_size: 64 * 1024)
+  ```
+
+  `DBF::Database::Foxpro.new` takes the same option.
+* Rescue `DBF::Error`, and also `StandardError` if a malformed file must never
+  fail a request.
+* `Table#to_csv` prefixes a `'` to string cells that begin with `=`, `+`, `-`,
+  `@`, tab, or carriage return so spreadsheets do not run them as formulas.
+* Text is passed through as it is, including Unicode bidirectional controls
+  (such as U+202E RIGHT-TO-LEFT OVERRIDE) and zero-width characters. These
+  make displayed text differ from the underlying data (in a web page, a CSV
+  export, or `dbf` terminal output), but some real data needs them, so the
+  library does not remove them. Strip or flag them yourself where that
+  matters:
+
+  ```ruby
+  value.gsub(/[​-‏‪-‮⁠-⁤⁦-⁩]/, '')
+  ```
+
+* Column descriptors that do not fit within the header length or record
+  length are ignored, and the library prints a warning (silenced when
+  `$VERBOSE` is nil). If a file you trust loses columns, its header has wrong
+  length fields.
+
 ## Limitations
 
 * DBF is read-only
@@ -374,25 +445,6 @@ Data type descriptions
 
 ## License
 
-Copyright (c) 2006-2024 Keith Morrison <<keithm@infused.org>>
-
-Permission is hereby granted, free of charge, to any person
-obtaining a copy of this software and associated documentation
-files (the "Software"), to deal in the Software without
-restriction, including without limitation the rights to use,
-copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the
-Software is furnished to do so, subject to the following
-conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
-OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
-HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-OTHER DEALINGS IN THE SOFTWARE.
+Copyright (c) 2006-2026 Keith Morrison <<keithm@infused.org>>
+
+Released under the MIT License. See [LICENSE](LICENSE) for the full text.

data/dbf.gemspec

@@ -15,7 +15,11 @@ Gem::Specification.new do |s|
   s.require_paths = ['lib']
   s.required_ruby_version = '>= 3.3.0'
   s.metadata['rubygems_mfa_required'] = 'true'
+  s.metadata['homepage_uri'] = 'https://github.com/infused/dbf'
   s.metadata['source_code_uri'] = 'https://github.com/infused/dbf'
   s.metadata['changelog_uri'] = 'https://github.com/infused/dbf/blob/main/CHANGELOG.md'
-  s.add_dependency 'csv'
+  s.metadata['bug_tracker_uri'] = 'https://github.com/infused/dbf/issues'
+  s.metadata['documentation_uri'] = 'https://dbf.infused.org'
+  s.metadata['funding_uri'] = 'https://github.com/sponsors/infused'
+  s.add_dependency 'csv', '~> 3.3'
 end

data/lib/dbf/cli.rb

@@ -5,13 +5,15 @@ require 'optparse'
 module DBF
   class CLI
     USAGE = <<~HELP
-      usage: dbf [-h|-s|-a|-c|-r] filename
+      usage: dbf [-h|-s|-a|-c|-r|-j|-J] filename
         -h = print this message
         -v = print the DBF gem version
         -s = print summary information
         -a = create an ActiveRecord::Schema
         -r = create a Sequel migration
         -c = export as CSV
+        -j = export as a JSON array
+        -J = export as JSON Lines (one record per line)
     HELP
 
     # Bytes a terminal interprets as control or escape sequences. A crafted
@@ -20,6 +22,9 @@ module DBF
     CONTROL_BYTES = /[\x00-\x1F\x7F]/n
     # The same, but keeping CR and LF so CSV row separators survive.
     CONTROL_BYTES_KEEPING_NEWLINES = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/n
+    # C1 controls (U+0080..U+009F) as UTF-8 bytes. Some terminals honor
+    # these, e.g. U+009B as a single-character CSI.
+    UTF8_C1_CONTROLS = /\xC2[\x80-\x9F]/n
 
     # Replaces terminal control bytes. Substitution happens on a byte copy so
     # a value whose bytes are invalid in its encoding cannot raise here.
@@ -29,7 +34,10 @@ module DBF
     # @return [String]
     def self.sanitize(value, pattern = CONTROL_BYTES)
       string = value.to_s
-      string.b.gsub(pattern, '?').force_encoding(string.encoding)
+      encoding = string.encoding
+      bytes = string.b.gsub(pattern, '?')
+      bytes = bytes.gsub(UTF8_C1_CONTROLS, '?') if encoding == Encoding::UTF_8
+      bytes.force_encoding(encoding)
     end
 
     # Wraps an IO so text written to an interactive terminal is stripped of
@@ -68,8 +76,17 @@ module DBF
       @stderr = stderr
     end
 
+    ACTIONS = {
+      'a' => :print_ar_schema,
+      'r' => :print_sequel_schema,
+      's' => :print_summary,
+      'c' => :print_csv,
+      'j' => :print_json,
+      'J' => :print_jsonl
+    }.freeze
+
     def run
-      params = OptionParser.new.getopts(@argv, 'h', 's', 'a', 'c', 'r', 'v')
+      params = OptionParser.new.getopts(@argv, 'hsacrvjJ')
 
       if params['v']
         print_version
@@ -79,17 +96,12 @@ module DBF
         filename = @argv.shift
         return missing_filename unless filename
 
-        action = %w[a r s c].find { |flag| params[flag] }
-        case action
-        when 'a' then print_ar_schema(filename)
-        when 'r' then print_sequel_schema(filename)
-        when 's' then print_summary(filename)
-        when 'c' then print_csv(filename)
-        end
+        action = ACTIONS.find { |flag, _method| params[flag] }&.last
+        send(action, filename) if action
       end
       0
-    rescue DBF::FileNotFoundError => e
-      @stderr.puts "DBF::FileNotFoundError: #{e.message}"
+    rescue DBF::FileError => e
+      @stderr.puts "#{e.class}: #{e.message}"
       1
     end
 
@@ -108,16 +120,23 @@ module DBF
       1
     end
 
+    # Always close the table when done: an open handle prevents deleting or
+    # replacing the file on Windows.
+    def with_table(filename, &) = DBF::Table.open(filename, &)
+
     def print_ar_schema(filename)
-      @stdout.puts terminal_safe(DBF::Table.new(filename).schema(:activerecord))
+      with_table(filename) { |table| @stdout.puts terminal_safe(table.schema(:activerecord)) }
     end
 
     def print_sequel_schema(filename)
-      @stdout.puts terminal_safe(DBF::Table.new(filename).schema(:sequel))
+      with_table(filename) { |table| @stdout.puts terminal_safe(table.schema(:sequel)) }
     end
 
     def print_summary(filename)
-      table = DBF::Table.new(filename)
+      with_table(filename) { |table| write_summary(filename, table) }
+    end
+
+    def write_summary(filename, table)
       @stdout.puts
       @stdout.puts "Database: #{filename}"
       @stdout.puts "Type: (#{table.version}) #{table.version_description}"
@@ -136,7 +155,54 @@ module DBF
     end
 
     def print_csv(filename)
-      DBF::Table.new(filename).to_csv(interactive? ? TerminalFilter.new(@stdout) : @stdout)
+      with_table(filename) { |table| table.to_csv(interactive? ? TerminalFilter.new(@stdout) : @stdout) }
+    end
+
+    # Streams a JSON array without materializing all records in memory.
+    # JSON string escaping makes the output terminal-safe by construction:
+    # control bytes are emitted as \uXXXX escapes.
+    def print_json(filename)
+      with_table(filename) { |table| write_json(table) }
+    end
+
+    def write_json(table)
+      first = true
+      @stdout.write('[')
+      each_present_record(table) do |record|
+        @stdout.write(first ? "\n" : ",\n")
+        @stdout.write(json_record(record))
+        first = false
+      end
+      @stdout.write("\n]\n")
+    end
+
+    # One JSON object per line (JSON Lines). Combined with chunked record
+    # reading this exports arbitrarily large files in constant memory.
+    def print_jsonl(filename)
+      with_table(filename) { |table| write_jsonl(table) }
+    end
+
+    def write_jsonl(table)
+      each_present_record(table) { |record| @stdout.write("#{json_record(record)}\n") }
+    end
+
+    # Deleted records have no attributes, so JSON export skips them.
+    def each_present_record(table, &)
+      table.each { |record| yield record if record }
+    end
+
+    def json_record(record)
+      JSON.generate(record.attributes.to_h { |key, value| [json_safe(key), json_safe(value)] })
+    end
+
+    # JSON.generate raises on binary or invalidly encoded strings; represent
+    # their bytes instead of raising, mirroring the CSV export behavior.
+    def json_safe(value)
+      return value unless value.is_a?(::String)
+
+      value.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: '?')
+    rescue Encoding::ConverterNotFoundError
+      value.dup.force_encoding(Encoding::UTF_8).scrub('?')
     end
 
     # Exported data is only filtered when it is going to a terminal, so

data/lib/dbf/column.rb

@@ -2,15 +2,20 @@
 
 module DBF
   class Column
-    class LengthError < StandardError
+    class LengthError < DBF::Error
     end
 
-    class NameError < StandardError
+    class InvalidNameError < DBF::Error
     end
 
+    # Deprecated alias, kept for backward compatibility. It shadowed
+    # ::NameError (without being one), so it was renamed.
+    NameError = InvalidNameError
+    deprecate_constant :NameError
+
     attr_reader :name, :type, :length, :decimal
 
-    # rubocop:disable Style/MutableConstant
+    # rubocop:disable-next Style/MutableConstant
     TYPE_CAST_CLASS = {
       N: ColumnType::Number,
       I: ColumnType::SignedLong,
@@ -24,7 +29,6 @@ module DBF
       G: ColumnType::General,
       :+ => ColumnType::AutoIncrement
     }
-    # rubocop:enable Style/MutableConstant
     TYPE_CAST_CLASS.default = ColumnType::String
     TYPE_CAST_CLASS.freeze
 
@@ -48,6 +52,17 @@ module DBF
 
     def encoding = @table.encoding
 
+    # Returns a copy of the column with a different name. The name is used
+    # as given rather than decoded from the table's code page, so it must
+    # already be a decoded string, such as a Visual FoxPro long name read
+    # from the .dbc container.
+    #
+    # @param name [String]
+    # @return [DBF::Column]
+    def with_name(name) # :nodoc:
+      dup.tap { |column| column.rename(name) }
+    end
+
     # @param value [String]
     def type_cast(value)
       type_cast_class.type_cast(value)
@@ -79,6 +94,14 @@ module DBF
       @underscored_name ||= name.gsub(/([a-z\d])([A-Z])/, '\1_\2').tr('-', '_').downcase
     end
 
+    protected
+
+    def rename(name) # :nodoc:
+      @name = name
+      @underscored_name = nil
+      validate_name
+    end
+
     private
 
     def clean(value) # :nodoc:
@@ -105,7 +128,7 @@ module DBF
     end
 
     def validate_name # :nodoc:
-      raise NameError, 'column name cannot be empty' if @name.empty?
+      raise InvalidNameError, 'column name cannot be empty' if @name.empty?
     end
   end
 end

data/lib/dbf/column_builder.rb

@@ -2,22 +2,46 @@
 
 module DBF
   class ColumnBuilder
-    def initialize(table, data, version_config)
+    def initialize(table, data, version_config, header_length:, record_length:)
       @table = table
       @data = data
       @version_config = version_config
+      @header_length = header_length
+      # One byte of every record is the deletion flag
+      @max_width = record_length - 1
     end
 
     def build
       safe_seek do
         @data.seek(@version_config.header_size)
+        width = 0
         [].tap do |columns|
           until end_of_record?
+            count = columns.size
+            # Descriptors live inside the header. Stop at header_length so a
+            # crafted file cannot declare thousands of columns over its
+            # record area.
+            if past_header?
+              warn_ignored(count, "header length of #{@header_length}")
+              break
+            end
+
             args = @version_config.read_column_args(@table, @data)
             # A descriptor truncated by EOF is returned as nil, or unpacks to
             # a nil length; stop rather than constructing an invalid column
             # (which would crash on nil < 0).
-            break if args.nil? || args[3].nil?
+            length = args&.[](3)
+            break if length.nil?
+
+            # Columns longer than the record would read into the following
+            # records; stop so a crafted file cannot multiply decoding work.
+            # Zero-length columns take no record bytes, so also allow at most
+            # one column per record byte.
+            width += length
+            if width > @max_width || count >= @max_width
+              warn_ignored(count, "record length of #{@max_width + 1}")
+              break
+            end
 
             columns << Column.new(*args)
           end
@@ -27,6 +51,18 @@ module DBF
 
     private
 
+    def past_header?
+      @data.pos + @version_config.column_layout.first > @header_length
+    end
+
+    # Columns that do not fit are dropped rather than read, so say so: a file
+    # written with a wrong header or record length would otherwise lose
+    # columns silently. The message holds no text from the file, so a
+    # crafted column name cannot inject lines into a log.
+    def warn_ignored(kept, limit)
+      warn "DBF: ignored the columns after the first #{kept}: they do not fit within the #{limit} bytes"
+    end
+
     def end_of_record?
       safe_seek do
         byte = @data.read(1)

data/lib/dbf/column_type.rb

@@ -112,7 +112,7 @@ module DBF
       # @param value [String]
       def type_cast(value)
         value.match?(/\d{8}/) && ::Date.strptime(value, '%Y%m%d')
-      rescue StandardError
+      rescue ArgumentError, RangeError, TypeError
         nil
       end
     end
@@ -121,11 +121,12 @@ module DBF
       # @param value [String]
       def type_cast(value)
         days, msecs = value.unpack('l2')
-        return nil if days.nil? || days.zero?
+        # A column narrower than 8 bytes leaves msecs nil
+        return nil if days.nil? || msecs.nil? || days.zero?
 
         secs = (msecs / 1000).to_i
         ::DateTime.jd(days, (secs / 3600).to_i, (secs / 60).to_i % 60, secs % 60).to_time
-      rescue StandardError
+      rescue ArgumentError, RangeError, TypeError
         nil
       end
     end
@@ -170,7 +171,13 @@ module DBF
       private
 
       def encode(value)
-        return value.force_encoding(encoding) unless @needs_encode
+        unless @needs_encode
+          # No transcoding happens here, so replace invalid bytes the same
+          # way Encoder.encode does rather than handing callers a string that
+          # raises in JSON generation, HTML escaping, or a database insert.
+          value.force_encoding(encoding)
+          return value.valid_encoding? ? value : value.scrub
+        end
 
         Encoder.encode(value, encoding, @target_encoding)
       end