A NUL injection vulnerability of File.fnmatch and File.fnmatch?

Built-in methods File.fnmatch and its alias File.fnmatch? accept the path
pattern as their first parameter. When the pattern contains NUL character
(\0), the methods recognize that the path pattern ends immediately before the
NUL byte. Therefore, a script that uses an external input as the pattern
argument, an attacker can make it wrongly match a pathname that is the second
parameter.