Update: Code moved below

If you comment either backtick out, it passes taint. If you have two variables getting assigned two backticks containing $$, it also works. Why is $$ only tainted when inside hashref and arrayref declarations and after it is used once?

Any ideas?

---

Update The problem seems to be with any variables whether they were used in a backtick previously or not.

<code>
#!/usr/bin/perl -T
use strict;
use warnings;
# Original code
$ENV{PATH} = '/usr/bin:/usr/local/bin:/bin';
$ENV{ENV} = '';

my $temp_fails = [ 
                   `mktemp /tmp/temp.$$.XXXXXX`,  
                   `mktemp /tmp/temp2.$$.XXXXXX`,
                  ];

#!/usr/bin/perl -T
use strict;
use warnings;

# This fails as well..
$ENV{PATH} = '/usr/bin:/usr/local/bin:/bin';
$ENV{ENV} = '';

my $untainted = 'foo';
my $also_untainted = 'foobar';
my $temp_fails = [ 
                   `mktemp /tmp/temp.$untainted.XXXXXX`,  
                   `mktemp /tmp/temp.$also_untainted.XXXXXX`,
                 ];

#This is perl, v5.6.1 built for sparc64-linux

# The following works ok
sub do_nothing { @_ };
$ENV{PATH} = '/usr/bin:/usr/local/bin:/bin';
$ENV{ENV} = '';
my $temp_fails = [ 
                   do_nothing(`mktemp /tmp/temp.$untainted.XXXXXX`),  
                   do_nothing(`mktemp /tmp/temp.$also_untainted.XXXXXX
+`),
                 ];
[download]