Taint mode does not identify Python keyword arguments as a source

[minusworld]

Describe the bug
In this example, https://semgrep.dev/s/4v4l, I want to match any instance of a string beginning with http:// that enters the sinks specified. This works in the expected case, but does not work when the string is the default string of a keyword argument.

To Reproduce
https://semgrep.dev/s/4v4l

Expected behavior
I expect this rule to match on lines 28 and 38 as it's written.

Screenshots

What is the priority of the bug to you?

• P0: blocking your adoption of Semgrep or workflow
• P1: important to fix or quite annoying
• P2: regular bug that should get fixed

Environment
If not using semgrep.dev: are you running off docker, an official binary, a local build?

Use case
What will fixing this bug enable for you?

Switching older "fake taint" rules to taint mode

[r2c-demo]

This issue is synced in Linear at https://linear.app/r2c/issue/PA-1990/taint-mode-does-not-identify-python-keyword-arguments-as-a-source. Note: this link is for r2c use only and is not accessible publicly.