in reply to
Re^3: Taint mode limitations
in thread Taint mode limitations
Perl isn't "guessing". It is following the clearly laid out rule for 'detainting'. That is:
"Perl presumes that if you reference a substring using $1, $2, etc., that you knew what you were doing when you wrote the pattern."
The problem with this is that the "clearly laid out rule for 'detainting'" is too ambiguous. In perl, Regexp matches are used to do a lot of different things, and removing malicious characters is only one of them. So for perl to assume that a variable derived from a tainted variable through a regexp match is "clean" is dangerous.
See what I wrote here: http://www.perlmonks.org/?node_id=1002125