glob is a source of external input when "*" is used.

You're right. A quick test shows, though, that it doesn't matter whether there's a '*' in the glob expression or not:

$ perl -MScalar::Util=tainted -TE'say tainted($_) for glob "foo"'
1
[download]