Python: Add taint-flow modeling for re module

[RasmusWL]

I ended up writing the tests first, and then did the modeling with flow-summaries instead of manually propagating flow to the object as we have been forced to do before.

I think overall it was nice to be able to write flow-summaries, although the lack of auto-completion when writing the input/output specs is a little annoying.

As a side effect of the way I worked, we do have some slightly funky test results, such as the one below -- Since we can say that only the first element of the tuple returned by re.subn is tainted, we don't actually taint the whole returned tuple like we used to (I added that "feature" in a few places, but with a TODO notice).

☝️ is more a note to reviewers why the tests look like they do, and that some of the MISSING annotations are actually fine... I wonder if we should remove those lines of the test though, to not confuese our future selves?

    re.subn(pat, repl="safe", string=ts), # $ MISSING: tainted
    re.subn(pat, repl="safe", string=ts)[0], # $ tainted // the string

(I recommend reviewing commit-by-commit)

[tausbn]

☝️ is more a note to reviewers why the tests look like they do, and that some of the MISSING annotations are actually fine... I wonder if we should remove those lines of the test though, to not confuese our future selves?

    re.subn(pat, repl="safe", string=ts), # $ MISSING: tainted
    re.subn(pat, repl="safe", string=ts)[0], # $ tainted // the string

In this case, wouldn't the right thing be to just remove the MISSING annotation entirely (and perhaps add a comment that only the first element of re.subn(...) is tainted)?

In my mind, MISSING comes with an implicit meaning of "but we really ought to have this", which -- as I understand it -- is not the case here.

[yoff]

I would go even further and add the lines where we do not expect taint under an ensure_not_tainted. This "feature" is similar to what we want to achieve with https://github.com/github/codeql-python-team/issues/728.

[RasmusWL]

Thanks for the good comments @tausbn and @yoff 🙏

[RasmusWL]

Performance looks fine 👍