The filename there is built from a directory path which is not tainted,
and a filename which is. This is a standard pattern for detainting
using a dsearch lookup - which as a bonus does the equivalent of "exists"
also. As the docs say (file & database lookups chapter, on dsearch)
"If lstat() succeeds then so does the lookup. The result is regarded as untainted."
So, use a ${lookup {tainted_thing} dsearch {untainted_path} {found} {not_found}}.
--
Cheers,
Jeremy
