G'day mikkoi,

You'll find a lot of information about taint mode in perlsec. In particular, for your problem, look at the "Laundering and Detecting Tainted Data" section. Here's a version of the regex solution, shown in that section, for your specific problem:

$ cat ../lib/MyLib.pm
package MyLib;

our $VERSION = '1.23';

1;

$ perl -T -e 'use FindBin 1.51 qw( $RealBin ); use lib "$RealBin/../li
+b"; use MyLib; print $MyLib::VERSION;'
Insecure dependency in require while running with -T switch at -e line
+ 1.
BEGIN failed--compilation aborted at -e line 1.

$ perl -T -e 'use FindBin 1.51 qw( $RealBin ); use lib @{["$RealBin/..
+/lib" =~ /^([\$\w\/.]+)$/ && $1]}; use MyLib; print $MyLib::VERSION;'
1.23
[download]

Update (minor code improvement): Just after posting, I realised you don't actually need the ' && $1' part:

$ perl -T -e 'use FindBin 1.51 qw( $RealBin ); use lib @{["$RealBin/..
+/lib" =~ /^([\$\w\/.]+)$/]}; use MyLib; print $MyLib::VERSION;'
1.23
[download]

The problem is that FindBin does its magic inside a BEGIN segment. Otherwise the variable wouldn't be useable in command lib which also operates within BEGIN segment.

You can apply the usual untainting mantra by also using a BEGIN section:

use strict;
use warnings;
use FindBin 1.51 qw( $RealBin );
BEGIN {
    ($RealBin) = $RealBin =~ /(.+)/;
}
use lib "$RealBin/../lib";

use MyLib;
[download]

Of course, you need to trust your installation to not mess with the current working directory (because this is why $RealBin comes out tainted in the first place).

This works. But is there any way to do the same without using the same $RealBin variable (which belongs to FindBin)?

Sure, you can use a copy, to be declared outside of the BEGIN block:

use strict;
use warnings;
use FindBin 1.51 qw( $RealBin );

my $untainted_bin;

BEGIN { ($untainted_bin) = $RealBin =~ /(.+)/; }

use lib "$untainted_bin/../lib";

use MyLib;
[download]