Python: Propagate taint through parse_qs

[RasmusWL]

Encountered this in Gruyere. It was not essential to anything, but we should handle it none the less.

reference: https://docs.python.org/3.8/library/urllib.parse.html#urllib.parse.parse_qs

[BekaValentine]

This all looks good. I take it that we were unable to track taint through the definitions of any of these things, or if we could, it wasn't enough b/c of not being able to analyze certain imports, etc.?

Could be useful to add a node why it's necessary to special case this as a taint source instead of just the URL itself and propagating from there.

[RasmusWL]

What an excellent question! I did not think about it, simply found that we didn't propagate taint properly, and made a fix.

So I looked over the urllib.parse code more in depth. Currently the taint stops at the call the _coerce_args -- to handle that case, we would need to track taint through star args (tracked in https://github.com/github/codeql-python-team/issues/49)

If that was solved the taint would stop because we currently don't propagate taint through str.split (fix in #3302).

Once these two problems have been fixed, it would be interesting to see if we can handle this case out-of-the-box without any special handling.

[RasmusWL]

No matter what, we should also handle parse_qsl 👍

[RasmusWL]

After adding support for parse_qsl I thought that this might be enough to get the taint for parse_qs working, but alas; although we figure out that pairs is tainted, neither name nor value gets tainted (source code) 😞 I'll try to investigate this a bit more in a different issue/PR.

In conclusion, for now, we need both of these special cases.

[tausbn]

One comment, otherwise LGTM.