It would be inefficient for every operator to test every argument for taintedness. Instead, the slightly more efficient and conservative approach is used that if any tainted value has been accessed within the same expression, the whole expression is considered tainted.

#!/usr/bin/perl -T
$ENV{PATH} = '/usr/bin:/usr/local/bin:/bin';
$ENV{ENV} = '';
my $good = 'good';
my $bad = `echo bad`;
print($bad); print(`echo $good`); #separate expressions
print($bad), print(`echo $good`); #single list expression
[download]

Maybe it's the way I'm reading that, but take the example below, I don't see how that applies. The second element isn't referencing anything that could be tainted.

#!/usr/bin/perl -T
$ENV{PATH} = '/usr/bin:/usr/local/bin:/bin';
$ENV{ENV} = '';
my $commands = [ 
                   `mktemp /tmp/temp.XXXXXX`,  
                   `mktemp /tmp/temp.XXXXXX`,
                 ];
[download]



-Lee

"To be civilized is to deny one's nature."

Doesn't matter. "It would be inefficient for every operator to test every argument for taintedness." Once you use tainted data in an expression, any unsafe operator in the same expression is going to trigger a taint exception now matter what its arguments are.