Supposition: taint is associated with the variable, not the value. Assigning to the variable doesn't clear the taint flag. Creating a new variable does. That's why my example worked.

Solution #1 is to fix Perl, if that's the proper remedy. Solution #2 is not to reuse $file to hold the contents of $1.

Yep. Assigning to a new variable does work (which is really what my code above does, of course). Problem is, if the taintedness is associated with the variable, and not with the value, there is effectively no way to untaint a variable. Even if you assign a literal to the variable, it is still tainted (and I just tested: it is still tainted). This doesn't seem right to me, and doesn't seem to be what is intended. Especially since the example code in perlsec for untainting data would actually fail.

From perlsec:

Here's a test to make sure that the data contains nothing
but "word" characters (alphabetics, numerics, and under-
scores), a hyphen, an at sign, or a dot.

    if ($data =~ /^([-\@\w.]+)$/) {
        $data = $1;                     # $data now untainted
    } else {
        die "Bad data in $data";        # log this somewhere
    }
[download]

Also, this "persistent variable taintedness" only seems to affect $class->isa().

#!/usr/bin/perl -wT

package Parent;
1;

package Child;
@ISA = qw(Parent);
1;

package main;

%ENV = ();

use strict;

our $isa;

$|++;
print "Type in something: ";
$isa = <STDIN>;

$isa = "/bin/ls";
print "(qx)  ", (eval { qx($isa); 1 } ? "Untainted" : "Tainted"), "\n"
+;

$isa = "Child";
print "(isa) ", ($isa->isa("Parent") ? "Untainted" : "Tainted"), "\n";
[download]

Produces:

Type in something: blah
(qx)  Untainted
(isa) Tainted
[download]

That really doesn't seem right to me.

bbfu
Black flowers blossum
Fearless on my breath