cool.io 1.9.3 → 1.9.5

data/lib/cool.io/dns_resolver.rb

@@ -18,6 +18,8 @@
 #++
 
 require 'resolv'
+require 'securerandom'
+require 'socket'
 
 module Coolio
   # A non-blocking DNS resolver.  It provides interfaces for querying both
@@ -67,14 +69,22 @@ module Coolio
     # list of nameservers to query.  By default the resolver will
     # use nameservers listed in /etc/resolv.conf
     def initialize(hostname, *nameservers)
+      nameservers = reject_ipv6_nameservers(nameservers)
       if nameservers.empty?
-        nameservers = Resolv::DNS::Config.default_config_hash[:nameserver]
+        nameservers = reject_ipv6_nameservers(Resolv::DNS::Config.default_config_hash[:nameserver])
         raise RuntimeError, "no nameservers found" if nameservers.empty? # TODO just call resolve_failed, not raise [also handle Errno::ENOENT)]
       end
 
       @nameservers = nameservers.dup
       @question = request_question hostname
 
+      # A guessable ID would let an off-path attacker forge a response
+      @request_id = SecureRandom.random_number(1 << 16)
+
+      # Numeric addresses this query was sent to, and the lookups behind them
+      @queried_addresses = []
+      @numeric_addresses = {}
+
       @socket = UDPSocket.new
       @timer = Timeout.new(self)
 
@@ -113,27 +123,44 @@ module Coolio
 
     # Send a request to the DNS server
     def send_request
-      nameserver = @nameservers.shift
-      @nameservers << nameserver # rotate them
+      @nameservers.rotate!
+
+      # Send to the numeric address, so we know where a response must come from
+      address = numeric_address(@nameservers.first)
+      @queried_addresses << address unless @queried_addresses.include?(address)
+
       begin
-        @socket.send request_message, 0, @nameservers.first, DNS_PORT
+        @socket.send request_message, 0, address, DNS_PORT
       rescue Errno::EHOSTUNREACH # TODO figure out why it has to be wrapper here, when the other wrapper should be wrapping this one!
       end
     end
 
     # Called by the subclass when the DNS response is available
     def on_readable
-      datagram = nil
+      datagram = sender = nil
       begin
-        datagram = @socket.recvfrom_nonblock(DATAGRAM_SIZE).first
+        datagram, sender = @socket.recvfrom_nonblock(DATAGRAM_SIZE)
       rescue Errno::ECONNREFUSED
       end
 
+      # Ignore anything we didn't ask for, rather than resolving or failing on it.
+      # The query stays outstanding, so the retry timer still bounds us.
+      return if datagram and not solicited_response?(datagram, sender)
+
       address = response_address datagram rescue nil
       address ? on_success(address) : on_failure
       detach
     end
 
+    # Is this a reply to our query, from an address we sent it to?
+    # Retries rotate through @nameservers, so any address already queried counts.
+    def solicited_response?(datagram, sender)
+      return false unless datagram.size >= 12
+      return false unless sender and sender[1] == DNS_PORT and @queried_addresses.include?(sender[3])
+
+      datagram[0..1].unpack('n').first.to_i == @request_id
+    end
+
     def request_question(hostname)
       raise ArgumentError, "hostname cannot be nil" if hostname.nil?
 
@@ -151,7 +178,7 @@ module Coolio
 
     def request_message
       # Standard query header
-      message = [2, 1, 0].pack('nCC')
+      message = [@request_id, 1, 0].pack('nCC')
 
       # One entry
       qdcount = 1
@@ -166,7 +193,7 @@ module Coolio
     def response_address(message)
       # Confirm the ID field
       id = message[0..1].unpack('n').first.to_i
-      return unless id == 2
+      return unless id == @request_id
 
       # Check the QR value and confirm this message is a response
       qr = message[2..2].unpack('B1').first.to_i
@@ -204,6 +231,23 @@ module Coolio
       nil
     end
 
+    private
+
+    def reject_ipv6_nameservers(nameservers)
+      nameservers.reject { |ns| ns.include?(':') }
+    end
+
+    # The address of a nameserver, which may be given as a hostname.
+    # Only successful lookups are cached, so a transient failure is looked up again.
+    def numeric_address(nameserver)
+      @numeric_addresses[nameserver] ||= begin
+        addrinfo = Addrinfo.getaddrinfo(nameserver, nil, ::Socket::AF_INET, ::Socket::SOCK_DGRAM).first
+        raise SocketError, "getaddrinfo: no IPv4 address for #{nameserver}" if addrinfo.nil?
+
+        addrinfo.ip_address
+      end
+    end
+
     class Timeout < TimerWatcher
       def initialize(resolver)
         @resolver = resolver

data/lib/cool.io/version.rb

@@ -1,6 +1,6 @@
 module Coolio
-  VERSION = "1.9.3"
-  
+  VERSION = "1.9.5"
+
   def self.version
     VERSION
   end

data/libev_win_select.diff

@@ -1,20 +1,26 @@
 diff --git a/ext/libev/ev.c b/ext/libev/ev.c
-index dae87f1..d15f6bd 100644
+index a59efb2..5c18fd6 100644
 --- a/ext/libev/ev.c
 +++ b/ext/libev/ev.c
-@@ -207,6 +207,7 @@
+@@ -210,6 +210,13 @@
  #else
  # include <io.h>
  # define WIN32_LEAN_AND_MEAN
-+# define FD_SETSIZE 1024
++/* ruby.h above already pulled in winsock2.h, so fd_set may be dimensioned
++ * already. Defining FD_SETSIZE unconditionally here would only move the bound
++ * used by EV_WIN_FD_SET, not the array it indexes. Take whatever is in effect
++ * and only supply a default when nothing has been decided yet. */
++# ifndef FD_SETSIZE
++#  define FD_SETSIZE 1024
++# endif
  # include <winsock2.h>
  # include <windows.h>
  # ifndef EV_SELECT_IS_WINSOCKET
 diff --git a/ext/libev/ev_select.c b/ext/libev/ev_select.c
-index f38d6ca..7050778 100644
+index ed1fc7a..eccff2b 100644
 --- a/ext/libev/ev_select.c
 +++ b/ext/libev/ev_select.c
-@@ -67,6 +67,54 @@
+@@ -67,6 +67,64 @@
  
  #include <string.h>
  
@@ -58,6 +64,16 @@ index f38d6ca..7050778 100644
 +#define EV_WIN_FD_ZERO(set) (((fd_set *)(set))->fd_count=0)
 +#define EV_WIN_FD_ISSET(fd, set) __WSAFDIsSet((SOCKET)(fd), (fd_set *)(set))
 +#define EV_WIN_FD_COUNT(set) (((fd_set *)(set))->fd_count)
++
++/*
++fd_set is dimensioned by whatever FD_SETSIZE was in effect when winsock2.h was
++first pulled in, but EV_WIN_FD_SET and select_modify bound-check against the
++FD_SETSIZE visible here. The two are decided by separate paths, so if the bound
++ever exceeds the declared array we would write past the end of the allocation in
++select_init. Catch that at build time instead.
++*/
++typedef char coolio_fd_setsize_matches_fd_set[
++	(sizeof (((fd_set *)0)->fd_array) / sizeof (SOCKET) >= (size_t)FD_SETSIZE) ? 1 : -1];
 +/* ######################################## */
 +#else
 +#define EV_WIN_FD_CLR FD_CLR
@@ -69,7 +85,7 @@ index f38d6ca..7050778 100644
  static void
  select_modify (EV_P_ int fd, int oev, int nev)
  {
-@@ -91,17 +139,17 @@ select_modify (EV_P_ int fd, int oev, int nev)
+@@ -91,17 +149,17 @@ select_modify (EV_P_ int fd, int oev, int nev)
      if ((oev ^ nev) & EV_READ)
      #endif
        if (nev & EV_READ)
@@ -91,7 +107,7 @@ index f38d6ca..7050778 100644
  
  #else
  
-@@ -197,8 +245,8 @@ select_poll (EV_P_ ev_tstamp timeout)
+@@ -197,8 +255,8 @@ select_poll (EV_P_ ev_tstamp timeout)
          {
            if (timeout)
              {
@@ -102,7 +118,7 @@ index f38d6ca..7050778 100644
              }
  
            return;
-@@ -230,10 +278,10 @@ select_poll (EV_P_ ev_tstamp timeout)
+@@ -230,10 +288,10 @@ select_poll (EV_P_ ev_tstamp timeout)
            int handle = fd;
            #endif
  
@@ -116,7 +132,7 @@ index f38d6ca..7050778 100644
            #endif
  
            if (expect_true (events))
-@@ -279,9 +327,9 @@ select_init (EV_P_ int flags)
+@@ -280,9 +338,9 @@ select_init (EV_P_ int flags)
    backend_poll    = select_poll;
  
  #if EV_SELECT_USE_FD_SET

data/spec/async_watcher_spec.rb

@@ -30,7 +30,9 @@ describe Cool.io::AsyncWatcher, :env => :exclude_win do
     end
 
     # ensure children are ready
-    nr_fork.times { expect(rd.sysread(1)).to eq('.') }
+    # rd may be O_NONBLOCK on macOS Ruby 3.2+ (IO.pipe sets O_NONBLOCK); use read
+    # instead of sysread so EAGAIN on an empty pipe is retried transparently.
+    nr_fork.times { expect(rd.read(1)).to eq('.') }
 
     # send our signals
     nr_signal.times { aw.signal }

data/spec/detach_race_condition_spec.rb

@@ -1,10 +1,13 @@
 require 'spec_helper'
 
 describe Cool.io::Loop do
+  # An IOWatcher that drains its pipe and then runs a user-supplied block,
+  # receiving itself as the argument.
   class Victim < Cool.io::IOWatcher
-    def initialize(io)
-      super
+    def initialize(io, &on_readable)
+      super(io)
       @io = io
+      @on_readable = on_readable
     end
 
     def on_readable
@@ -12,39 +15,103 @@ describe Cool.io::Loop do
         @io.read_nonblock(1024)
       rescue IO::WaitReadable, EOFError
       end
+      @on_readable.call(self) if @on_readable
     end
   end
 
   # https://github.com/socketry/cool.io/issues/87
-  it "does not raise TypeError when a watcher is detached while an event is pending" do
-    loop = Cool.io::Loop.default
-
+  #
+  # Several watchers have an event pending in the same loop iteration.  When the
+  # first one dispatched detaches the others, the loop must skip their now-stale
+  # pending events instead of dispatching them to a detached watcher.  Before the
+  # fix that raised "TypeError: wrong argument type nil (expected Coolio::Loop)"
+  # and could crash the VM.
+  #
+  # This is exercised deterministically within a single thread (a preceding
+  # callback detaching another watcher in the same loop cycle).  The original
+  # reproduction detached from a separate thread while the loop was polling,
+  # which is an unsupported concurrent mutation of libev (not thread-safe) and
+  # crashed intermittently on macOS.
+  it "does not raise when a watcher with a pending event is detached during dispatch" do
     iterations = 200
 
     expect {
       iterations.times do
-        r_victim, w_victim = IO.pipe
-        victim_watcher = Victim.new(r_victim)
-        victim_watcher.attach(loop)
+        coolio_loop = Cool.io::Loop.new
+        pipes = []
+        watchers = []
 
-        t1 = Thread.new do
-          sleep 0.01
-          w_victim.write("dummy\n")
-        end
+        5.times do
+          r, w = IO.pipe
+          pipes << [r, w]
+
+          watcher = Victim.new(r) do |fired|
+            # Detach every other watcher whose event is already queued for this
+            # same loop iteration.
+            watchers.each do |other|
+              other.detach if !other.equal?(fired) && other.attached?
+            end
+          end
+          watcher.attach(coolio_loop)
+          watchers << watcher
 
-        t2 = Thread.new do
-          sleep 0.01
-          victim_watcher.detach
+          w.write("dummy\n") # make the read end readable so an event is pending
         end
 
-        loop.run_once
+        coolio_loop.run_once
 
-        t1.join
-        t2.join
+        # Only the first dispatched watcher runs; it detaches the other four,
+        # whose pending events are then skipped.
+        expect(watchers.count(&:attached?)).to eq(1)
 
-        r_victim.close
-        w_victim.close
+        watchers.each { |watcher| watcher.detach if watcher.attached? }
+        pipes.each { |r, w| r.close; w.close }
       end
     }.not_to raise_error
   end
+
+  class HttpHandler < Coolio::IO
+    RESPONSE = "HTTP/1.1 200 OK\r\nContent-Length: 1024\r\nConnection: close\r\n\r\n" + ("X" * 1024)
+
+    def on_connect
+    end
+
+    def on_read(data)
+      write(RESPONSE)
+    end
+
+    def on_write_complete
+      close
+    end
+  end
+
+  # https://github.com/socketry/cool.io/issues/89
+  it "does not cause memory leaks" do
+    port = 18989
+    loop = Coolio::Loop.default
+
+    server = Coolio::TCPServer.new('127.0.0.1', port, HttpHandler)
+    server.attach(loop)
+
+    event_thread = Thread.new { loop.run }
+
+    request = "GET / HTTP/1.1\r\nHost: localhost\r\n\r\n"
+
+    10.times do |iteration|
+      begin
+        sock = TCPSocket.new('127.0.0.1', port)
+        sock.write(request)
+        sock.read
+        sock.close
+      rescue => e
+        sleep 0.01
+        retry
+      end
+    end
+
+    server.close
+    event_thread.join
+
+    expect(loop.watchers).to be_empty
+  end
 end

data/spec/dns_spec.rb

@@ -1,4 +1,5 @@
 require File.expand_path('../spec_helper', __FILE__)
+require 'tempfile'
 
 VALID_DOMAIN = "google.com"
 INVALID_DOMAIN = "gibidigibigididibitidibigitibidigitidididi.com"
@@ -55,4 +56,189 @@ describe "DNS" do
       expect( Coolio::DNSResolver.hosts("localhost", file.path)).to eq @preferred_localhost_address
     end
   end
+
+  describe "IPv6 nameserver filtering" do
+    it "ignores IPv6 nameservers provided in arguments" do
+      resolver = Coolio::DNSResolver.new("example.com", "8.8.8.8", "2001:4860:4860::8888", "1.1.1.1")
+
+      nameservers = resolver.instance_variable_get(:@nameservers)
+      expect(nameservers).to eq(["8.8.8.8", "1.1.1.1"])
+    end
+
+    it "falls back to default IPv4 config if only IPv6 addresses are provided" do
+      allow(Resolv::DNS::Config).to receive(:default_config_hash).and_return({
+        nameserver: ["8.8.4.4", "2001:4860:4860::8844"]
+      })
+
+      resolver = Coolio::DNSResolver.new("example.com", "2001:4860:4860::8888")
+
+      nameservers = resolver.instance_variable_get(:@nameservers)
+      expect(nameservers).to eq(["8.8.4.4"])
+    end
+  end
+
+  describe "nameserver normalization" do
+    let(:localhost_address) do
+      Addrinfo.getaddrinfo("localhost", nil, ::Socket::AF_INET, ::Socket::SOCK_DGRAM).first.ip_address
+    end
+
+    it "keeps the nameserver list as given" do
+      resolver = Coolio::DNSResolver.new("example.com", "localhost")
+
+      expect(resolver.instance_variable_get(:@nameservers)).to eq(["localhost"])
+    end
+
+    it "queries the numeric address of a nameserver given as a hostname" do
+      resolver = Coolio::DNSResolver.new("example.com", "localhost")
+      resolver.__send__(:send_request)
+
+      expect(resolver.instance_variable_get(:@queried_addresses)).to eq([localhost_address])
+    end
+
+    it "accepts responses from a nameserver which was given as a hostname" do
+      resolver = Coolio::DNSResolver.new("example.com", "localhost")
+      resolver.__send__(:send_request)
+      response = dns_response_for(resolver)
+
+      expect(
+        resolver.__send__(:solicited_response?, response, ["AF_INET", 53, localhost_address, localhost_address])
+      ).to be true
+    end
+
+    it "looks a nameserver up once and reuses the result on retries" do
+      resolved = Addrinfo.getaddrinfo("127.0.0.1", nil, ::Socket::AF_INET, ::Socket::SOCK_DGRAM)
+      resolver = Coolio::DNSResolver.new("example.com", "127.0.0.1")
+
+      expect(Addrinfo).to receive(:getaddrinfo).once.and_return(resolved)
+
+      3.times { resolver.__send__(:send_request) }
+    end
+
+    it "does not reject an unresolvable nameserver at construction" do
+      allow(Addrinfo).to receive(:getaddrinfo).and_raise(SocketError, "getaddrinfo: Name or service not known")
+
+      expect do
+        Coolio::DNSResolver.new("example.com", "no-such-nameserver.invalid")
+      end.to_not raise_error
+    end
+
+    it "surfaces an unresolvable nameserver as a SocketError from the request" do
+      allow(Addrinfo).to receive(:getaddrinfo).and_raise(SocketError, "getaddrinfo: Name or service not known")
+      resolver = Coolio::DNSResolver.new("example.com", "no-such-nameserver.invalid")
+
+      expect { resolver.attach(@loop) }.to raise_error(SocketError)
+      expect(@loop.watchers).to be_empty
+    end
+
+    it "recovers when a nameserver is only transiently unresolvable" do
+      resolved = Addrinfo.getaddrinfo("127.0.0.1", nil, ::Socket::AF_INET, ::Socket::SOCK_DGRAM)
+      resolver = Coolio::DNSResolver.new("example.com", "ns.example.test")
+
+      attempts = 0
+      allow(Addrinfo).to receive(:getaddrinfo) do
+        attempts += 1
+        raise SocketError, "getaddrinfo: Name or service not known" if attempts == 1
+
+        resolved
+      end
+
+      expect { resolver.__send__(:send_request) }.to raise_error(SocketError)
+      expect { resolver.__send__(:send_request) }.to_not raise_error
+      expect(resolver.instance_variable_get(:@queried_addresses)).to eq(["127.0.0.1"])
+    end
+  end
+
+  describe "response validation" do
+    let(:nameserver) { "127.0.0.1" }
+    let(:sender) { ["AF_INET", 53, nameserver, nameserver] }
+    let(:resolver) do
+      Coolio::DNSResolver.new("example.com", nameserver).tap { |r| r.__send__(:send_request) }
+    end
+
+    it "uses an unpredictable transaction ID for each query" do
+      ids = 10.times.map do
+        request_id_of(Coolio::DNSResolver.new("example.com", nameserver))
+      end
+
+      expect(ids.uniq.size).to be > 1
+    end
+
+    it "accepts a response carrying our transaction ID from the queried nameserver" do
+      expect(
+        resolver.__send__(:solicited_response?, dns_response_for(resolver), sender)
+      ).to be true
+    end
+
+    it "rejects a response carrying a different transaction ID" do
+      forged = dns_response_for(resolver, id: (request_id_of(resolver) + 1) % 65536)
+
+      expect(resolver.__send__(:solicited_response?, forged, sender)).to be false
+    end
+
+    it "rejects a response from a source address we did not query" do
+      response = dns_response_for(resolver)
+
+      expect(
+        resolver.__send__(:solicited_response?, response, ["AF_INET", 53, "10.11.12.13", "10.11.12.13"])
+      ).to be false
+    end
+
+    it "rejects a response arriving before the request was sent" do
+      unsent = Coolio::DNSResolver.new("example.com", nameserver)
+
+      expect(unsent.__send__(:solicited_response?, dns_response_for(unsent), sender)).to be false
+    end
+
+    it "rejects a response from a source port other than the DNS port" do
+      response = dns_response_for(resolver)
+
+      expect(
+        resolver.__send__(:solicited_response?, response, ["AF_INET", 4444, nameserver, nameserver])
+      ).to be false
+    end
+
+    it "rejects a truncated datagram" do
+      expect(resolver.__send__(:solicited_response?, "\0\0", sender)).to be false
+    end
+
+    it "resolves from a response sent by the queried nameserver" do
+      response = dns_response_for(resolver, address: "1.2.3.4")
+      allow(resolver.instance_variable_get(:@socket)).to receive(:recvfrom_nonblock).and_return([response, sender])
+
+      expect(resolver).to receive(:on_success).with("1.2.3.4")
+      expect(resolver).to receive(:detach)
+
+      resolver.__send__(:on_readable)
+    end
+
+    it "ignores a spoofed response instead of resolving or failing it" do
+      forged = dns_response_for(resolver, address: "6.6.6.6")
+      allow(resolver.instance_variable_get(:@socket)).to receive(:recvfrom_nonblock)
+        .and_return([forged, ["AF_INET", 53, "10.11.12.13", "10.11.12.13"]])
+
+      expect(resolver).to_not receive(:on_success)
+      expect(resolver).to_not receive(:on_failure)
+      expect(resolver).to_not receive(:detach)
+
+      resolver.__send__(:on_readable)
+    end
+  end
+
+  def request_id_of(resolver)
+    resolver.__send__(:request_message)[0..1].unpack('n').first
+  end
+
+  # A response to the resolver's own query: header plus the echoed question,
+  # and an A record when an address is given.
+  def dns_response_for(resolver, id: request_id_of(resolver), address: nil)
+    question = resolver.instance_variable_get(:@question)
+    answer = if address
+      # Compressed name pointer, type A, class IN, TTL, RDLENGTH, RDATA
+      [0xc00c, 1, 1, 60, 4].pack('nnnNn') + address.split('.').map(&:to_i).pack('CCCC')
+    else
+      ""
+    end
+
+    [id, 0x81, 0x80, 1, answer.empty? ? 0 : 1, 0, 0].pack('nCCnnnn') + question + answer
+  end
 end

data/spec/iobuffer_spec.rb

@@ -31,6 +31,18 @@ describe Cool.io::Buffer do
       expect(buffer << "baz").to eq "baz"
       expect(buffer.read 3).to eq "arb"
     end
+
+    it "raises ArgumentError for a length below one" do
+      buffer << "foo"
+      expect { buffer.read 0 }.to raise_error ArgumentError
+      expect { buffer.read(-1) }.to raise_error ArgumentError
+    end
+
+    it "clamps a length which does not fit in a C int to the buffer size" do
+      buffer << "foobar"
+      expect(buffer.read 2**31).to eq "foobar"
+      expect(buffer.size).to eq 0
+    end
   end
   
   describe "provides methods for performing non-blocking I/O" do
@@ -142,6 +154,25 @@ describe Cool.io::Buffer do
       expect(data).to eq "foo\nbarbaz"
       expect(buffer.to_str).to eq ""
     end
+
+    it "raises TypeError instead of crashing when data is not a String" do
+      buffer << "hello world"
+      expect { buffer.read_frame 12345, " ".ord }.to raise_error(TypeError)
+      expect { buffer.read_frame nil, " ".ord }.to raise_error(TypeError)
+      expect { buffer.read_frame [], " ".ord }.to raise_error(TypeError)
+    end
+
+    it "raises FrozenError when data is a frozen String" do
+      buffer << "hello world"
+      expect { buffer.read_frame "frozen".freeze, " ".ord }.to raise_error(FrozenError)
+    end
+
+    it "coerces objects responding to #to_str" do
+      buffer << "foo\nbar"
+      convertible = Object.new
+      def convertible.to_str; +""; end
+      expect(buffer.read_frame convertible, "\n".ord).to eq true
+    end
   end
 
 end

data/spec/stat_watcher_spec.rb

@@ -18,12 +18,31 @@ class MyStatWatcher < Cool.io::StatWatcher
   end
 end
 
-def run_with_file_change(path)
+def run_with_file_change(path, compact: false)
   reactor = Cool.io::Loop.new
 
   sw = MyStatWatcher.new(path)
   sw.attach(reactor)
 
+  # libev retains the path pointer passed to ev_stat_init() for the lifetime of
+  # the watcher.  If the watcher held RSTRING_PTR(@path) directly, a compaction
+  # that relocates the @path String would leave libev dereferencing a stale
+  # address on every stat.  Force a maximal relocation here so the watcher keeps
+  # operating against a path buffer it owns rather than Ruby-managed memory.
+  if compact
+    if GC.respond_to?(:verify_compaction_references)
+      # verify_compaction_references moves every movable object to a fresh slot.
+      # Its keyword arguments have varied across Ruby versions, so fall back.
+      begin
+        GC.verify_compaction_references(expand_heap: true, toplevel: true)
+      rescue ArgumentError
+        GC.verify_compaction_references(expand_heap: true)
+      end
+    elsif GC.respond_to?(:compact)
+      GC.compact
+    end
+  end
+
   tw = Cool.io::TimerWatcher.new(INTERVAL, true)
   tw.on_timer do
     reactor.stop if sw.accessed
@@ -69,6 +88,17 @@ describe Cool.io::StatWatcher do
     expect(watcher.previous.ino).to eq(watcher.current.ino)
   end
 
+  it "keeps firing on_change after GC compaction relocates objects" do
+    skip "GC compaction not available" unless GC.respond_to?(:compact)
+
+    watcher = run_with_file_change(TEMP_FILE_PATH, compact: true)
+    expect(watcher.accessed).to eq(true)
+  end
+
+  it "raises ArgumentError when the path contains a null byte" do
+    expect { MyStatWatcher.new("foo\0bar") }.to raise_error(ArgumentError)
+  end
+
   it "should raise when the handler does not take 2 parameters" do
     class MyStatWatcher < Cool.io::StatWatcher
       remove_method :on_change