The First Rule of Taint Club 

• Taint sticks

my $path = "/var/run/timestamps/";   # $path is not tainted

my $filename = $ARGV[0];             # $filename is tainted

my $path .= $filename;               # $path is now tainted too