sensible way to untaint $ENV{'PATH'} without losing the portability

Just set $ENV{'PATH'} to /bin:/usr/bin. That's what you get by default when nothing else is set (default set in init, libc, and some other places), and that's where all important binaries can be found. If you need "exotic programs" that are not in /bin or /usr/bin, put their path into the configuration file.

my $path = $ENV{'PATH'};
$ENV{'PATH'} = undef;
foreach my $p(split /:/, $path) {
    if ($p =~ m!^(/(usr|bin).*)!) {
        $ENV{'PATH'} .= ':' if $ENV{'PATH'};
        $ENV{'PATH'} .= $1;
    }
}
[download]

That looks broken.

You add every element of PATH to the new PATH if it starts with /usr or /bin. Including /usr/u0/evil.me (that's how HOME once looked like, before /home became common), /binary/garbage, /usr.corrupted, /usr/sbin, /usr/svr4/bin, /usr/etc, and so on.

Also, why don't you use join to combine the "cleaned" elements?

Just don't. The predefined PATH is unreliable, that's why perl considers it tainted. Set a sane default, don't try to repair the mess found in PATH. It just makes things worse. /bin:/usr/bin is sane.

Alexander