In trying to run some code with taint checking, I found the following snippet:

local $/; my %conf = eval <CONF>;
[download]

Needless to say, that fails in taint mode.

How about if you add:

use IO::Handle;
CONF->untaint;
[download]

This snippet, for example, seems to work as expected:

#!/usr/bin/perl -Tw

use strict;

use IO::Handle;
use Data::Dumper;

open(CONF,"< t41.conf")
  or die "couldn't open conf: $!\n";
CONF->untaint;
my %conf;
{
  local $/;
  undef $/;
  %conf = eval <CONF>;
}

print Dumper \%conf;
[download]