added test for vulnerable call to echo