#!/usr/bin/perl -T
use strict;
use warnings;

$ENV{PATH} = '/usr/bin:/usr/local/bin:/bin';
$ENV{ENV} = '';

my $tainted = `echo "FOO"`;

my $vars =  [ 
                   $tainted,  
                   `echo "BAR"`,
                 ];
[download]

Interesting...

rc       <1> srefgen sK/1 ->rd
-           <1> ex-list lKRM ->rc
rb             <@> anonlist sKRM/1 ->rc
r7                <0> pushmark s ->r8
r8                <0> padsv[$tainted:50,end] l ->r9
ra                <1> backtick[t6] lK ->rb
-                    <0> ex-pushmark s ->r9
r9                   <$> const(PV "echo \"BAR\"") s ->ra
[download]

The taintedness only gets checked or tirggered by an operation; 'padsv' just pushes a value on the stack, so the expression as a whole isn't tainted yet.

I'd have to go with bug as the following works..

#!/usr/bin/perl -T
use strict;
use warnings;
$ENV{PATH} = '/usr/bin:/usr/local/bin:/bin';
$ENV{ENV} = '';

sub do_nothing {  @_; }


my $vars =  [ 
              do_nothing( `echo "base"`),  
              do_nothing(`echo "BAR"`),
            ];
[download]



-Lee

"To be civilized is to deny one's nature."