You are right, it has bugs. Perl is not that easy to parse.

This regexp, for example, allows the following string

#!perl
qq, {z => "${warn qq/hello world/}" },
[download]

which, when evalled, prints a warning message. You can imagine that I could put more unsecure code in there than that.

My advice is that you don't try to evaluate untrusted perl (or shell or ruby) code, as you just can't launder it clean by parsing it.

Interpretting the code you're trying to parse yourself would be a much better idea. I'm as surprised as you there's no module for that.