Beefy Boxes and Bandwidth Generously Provided by pair Networks
DiBona good chemistry is complicated, and a little bit messy -LW
Comment on  Given that the exploit relies on using byte
sequences that cannot be interpreted as valid utf8 strings, I
would think that anyone writing a script that uses the "-T"
flag, and expects to handle utf8 data from a tainted source,
would prefer to read such input as ":raw", and always use
Encode::decode() to convert it to perl-internal utf8 form.  And
in doing so, it would usually be prudent to do it like this
(adapting the sample code given in the OP):  #!/usr/bin/perl -T
use strict; use Encode; %ENV = ( PATH => '/usr/bin' ); open my
$filehandle, "< :raw", "test.bin" or die $!; my $word = readline
$filehandle; eval { $word = decode( "utf8", $word,
Encode::FB_CROAK ) }; if ( $@ ) { warn "unusable input from
test.bin\n"; } else { my ($untainted) = $word =~ /^(\w+)$/; if
($untainted) { # It passed the regex, so it is "safe". system
"echo $untainted"; } }   and:  <code> code her