My choice for untainting filenames is: 

    my $filename= $param =~ m#^(\w[-.\w]*)\z#
      or  die "Invalid file name ($param).\n";

[download]
which allows for plenty of choice in naming the file but doesn't allow anything unsafe to be used. If this is a situation where you want to allow full paths and don't have any worries about the use of "..", then you can do: 
    my $filepath= $param =~ m#^((?:/?[.\w][-.\w]*)+)\z#
      or  die "Invalid file path ($param).\n";

[download]
Or be more portable by using File::Spec to split the $param into components and untaint each: 
#!/usr/bin/perl -w
use strict;

use File::Spec::Functions qw( splitpath splitdir catdir catpath );

for my $path (  @ARGV  ) {
    eval {
        warn "($path) => (", untaintPath( $path ), ")\n";
        1;
    }  or
        warn "$@\n";
}
exit( 0 );

sub untaintPath {
    my( $param )= @_;
    my( $vol, $dirs, $file )= splitpath( $param );
    ## my( $clean )= $file =~ m#^(\w[-.\w]*)\z#
    my( $clean )= $file =~ m#^(\w[-.\w]*|)\z#
      or  die "Invalid file name ($file) in path ($param).\n";
    $file= $clean;
    my @dirs= splitdir( $dirs );
    for my $dir (  @dirs  ) {
        ##( $clean )= $dir =~ m#^([.\w][-.\w]*|)\z#
        ( $clean )= $dir =~ m#^(\w[-\w]*|)\z#
          or  die "Invalid dir name ($dir) in path ($param).\n";
        $dir= $clean;
    }
    $dirs= catdir( @dirs );
    if(  "" eq $dirs  &&  "" eq $file  ) {
        die "Empty dir/file in path ($param).\n";
    }
    return catpath( $vol, $dirs, $file );
}

[download]
*shrug*

                - tye

In reply to Re^5: Unexpected file test (-f) result on Windows (untaint) by tye
in thread Unexpected file test (-f) result on Windows by DaveH

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.