bugzilla still relies on perl's non-existing tainting of hash keys. I fixed that about 10 years ago, but perl5 never did.