Perl v5.20 fixes taint checking in regular expressions that might use the locale in its pattern, even if that part of the pattern isn’t a successful part of the match. The perlsec documentation has noted that taint-checking did that, but until v5.20, it didn’t.
The only approved way to untaint a variable is through a successful pattern match with captures: Continue reading “Perl v5.20 fixes taint problems with locale”