Throw some ifs in there, cowboy:

if ($file =~ /^([-\w.]+$/) {
    $file = $1;
} else {
    print "Couldn't untaint \$file!\n";
}
[download]

Assuming success won't help -- if it fails, either the taint will persist or you'll get the results of the first capture from the last successful match.

(I had to look up the behavior of '.' within a character class, 'cuz I so rarely use it.)