Python: Add taint for urlsplit

[RasmusWL]

This is actually a part of my effort for writing the SSRF query, but I think we can discuss this part without the rest.

I'm a bit skeptical about this change, since we don't handle the sanitation steps below. Would very much like your opinion @tausbn. How do we proceed from here?

def test_sanitizer():
    tainted_string = TAINTED_STRING
    urlsplit_res = urlsplit(tainted_string)

    if urlsplit_res.netloc == "OK":
        test(urlsplit_res.netloc) # TODO: FP, should not be tainted here

    if urlsplit_res[2] == "OK":
        test(urlsplit_res[0]) # TODO: FP, should not be tainted here

Could I write a query that finds such places? Yes, yes I could... https://lgtm.com/query/1626963161462581314/

[RasmusWL]

I ended up writing a sanitizer for this. It's not a perfect solution, since I couldn't find a way to turn it on by default -- so right now the extra taint from urlsplit/urlparse is enabled by default, but the sanitizer isn't 😕

Anyway, do you feel happy about this @tausbn ? I realize now that I forgot to discuss this approach in person 😅

[tausbn]

In the short term, I think this solution is fine, especially as it'll unblock you on the larger query you're working. We definitely need a better way of handling this, though.

One comment to address, otherwise ready to merge.