pro: tainting: Track taint through tuple/list (un)packing

[IagoAbal]

DRAFT

def foo():
  return (ok, tainted)

def bar():
  x = foo()
  sink(x[1])

[github-actions]

PR checklist:

• Purpose of the code is evident to future readers
• Tests included or PR comment includes a reproducible test plan
• Documentation is up-to-date
• A changelog entry was added to changelog.d for any user-facing change
• Change has no security implications (otherwise, ping security team)

If you're unsure about any of this, please see:

• Contribution guidelines!
• One of the more specific guides located here

[r2c-argo]

semgrep-compare-github-h9aqp results

Ran benchmark on 38 repositories

The number of findings differs for 3 repos

Whole benchmark is 2.1% slower (a bit of noise is expected)

Relative speed improvement is 0.99 on average

• 3% of scans are significantly faster
• 5% of scans are significantly slower

Relative memory improvement is 1.00 on average