Show quoted text> The coderef returned by FV_eq_with returns true or false instead of the
> untainted param value.
And perhaps it shouldn't. Comparing that values are equal doesn't provide any
assurance that either one is safe.
The underlying tainting system is based on checking that values match safe
patterns, which this constraint doesn't do. Therefore, it doesn't strike me as
wise to fake untainting of the values here.
The constraint also can't know which of the two inputs might be "safe", to
pre-empt the suggestion that if one of the inputs is safe and they are equal,
then the other input should be safe, too.
If you'd like to discuss it further, I suggest doing so on the users mailing
list, so you could get more perspectives besides my own.
Mark
RT for rt.cpan.org