Merlin: specification inference for explicit information flow problems
The essence of command injection attacks in web applications