Should there be a general check for "naughty match variables" for code submitted to CPAN?
Maybee. But, there may be cases were the author may choose to make life simpler by using those variables. A simple example is the following code which extracts relative context from a full text match.

while (<DATA>){
  while ($_ =~/(^|\W)CPAN(\W)/gi){
  print substr($`,length($`)-10) . $& . substr($',0,10) . "\n";
  }
}
__DATA__
To my great surprise, when I traced it out I found two CPAN modules (s
+o far) that we use are also tainted in this way: Printer and Math::Ma
+trixReal.  I have sent mail to the maintainers of these modules point
+ing out the issue.  It makes me wonder how many other CPAN modules ar
+e tainted with "naughty match variables".
[download]

Output:

ZAZ@localhost ~
$ perl sample.pl
 found two CPAN modules

many other CPAN modules ar

Standard untested code caveat...

----
Zak
Pluralitas non est ponenda sine neccesitate - mysql's philosphy