my ($untained_file) = $file =~ /^(\w+)$/ or die "bad filename: $file";