static taint analysis