my $filename= $param =~ m#^(\w[-.\w]*)\z# or die "Invalid file name ($param).\n"; #### my $filepath= $param =~ m#^((?:/?[.\w][-.\w]*)+)\z# or die "Invalid file path ($param).\n"; #### #!/usr/bin/perl -w use strict; use File::Spec::Functions qw( splitpath splitdir catdir catpath ); for my $path ( @ARGV ) { eval { warn "($path) => (", untaintPath( $path ), ")\n"; 1; } or warn "$@\n"; } exit( 0 ); sub untaintPath { my( $param )= @_; my( $vol, $dirs, $file )= splitpath( $param ); ## my( $clean )= $file =~ m#^(\w[-.\w]*)\z# my( $clean )= $file =~ m#^(\w[-.\w]*|)\z# or die "Invalid file name ($file) in path ($param).\n"; $file= $clean; my @dirs= splitdir( $dirs ); for my $dir ( @dirs ) { ##( $clean )= $dir =~ m#^([.\w][-.\w]*|)\z# ( $clean )= $dir =~ m#^(\w[-\w]*|)\z# or die "Invalid dir name ($dir) in path ($param).\n"; $dir= $clean; } $dirs= catdir( @dirs ); if( "" eq $dirs && "" eq $file ) { die "Empty dir/file in path ($param).\n"; } return catpath( $vol, $dirs, $file ); }