My choice for untainting filenames is:

    my $filename= $param =~ m#^(\w[-.\w]*)\z#
      or  die "Invalid file name ($param).\n";
[download]

    my $filepath= $param =~ m#^((?:/?[.\w][-.\w]*)+)\z#
      or  die "Invalid file path ($param).\n";
[download]

#!/usr/bin/perl -w
use strict;

use File::Spec::Functions qw( splitpath splitdir catdir catpath );

for my $path (  @ARGV  ) {
    eval {
        warn "($path) => (", untaintPath( $path ), ")\n";
        1;
    }  or
        warn "$@\n";
}
exit( 0 );

sub untaintPath {
    my( $param )= @_;
    my( $vol, $dirs, $file )= splitpath( $param );
    ## my( $clean )= $file =~ m#^(\w[-.\w]*)\z#
    my( $clean )= $file =~ m#^(\w[-.\w]*|)\z#
      or  die "Invalid file name ($file) in path ($param).\n";
    $file= $clean;
    my @dirs= splitdir( $dirs );
    for my $dir (  @dirs  ) {
        ##( $clean )= $dir =~ m#^([.\w][-.\w]*|)\z#
        ( $clean )= $dir =~ m#^(\w[-\w]*|)\z#
          or  die "Invalid dir name ($dir) in path ($param).\n";
        $dir= $clean;
    }
    $dirs= catdir( @dirs );
    if(  "" eq $dirs  &&  "" eq $file  ) {
        die "Empty dir/file in path ($param).\n";
    }
    return catpath( $vol, $dirs, $file );
}
[download]