The taint flag is not propagated at JSON.parse