fix(taint): retain sources across reassignment

[efegokdemir]

Fixes #750

The taint worklist now retains and propagates one fact per source for each variable, so reassignment cannot hide a stronger source classification. Regression coverage exercises both assignment orders and propagation through an alias into a shell sink.

Tests:

• pytest -q tests/nodes/analyzers/test_behavioral_taint_tracking.py (78 passed)
• ruff check on the changed files
• ruff format --check on the changed files
• git diff --check

[rng1995]

[SkillSpector Review]

@efegokdemir thank you for picking up #750, and for testing both assignment orders through an alias into a shell sink.

Value and readiness

The change does what #750 asks. Each name now keeps one fact per source, so a reassignment can no longer hide input() behind an earlier os.getenv() (TT5 vs TT2), and the worklist still terminates. I found no correctness defect. The branch merges cleanly with main, and CI is green.

I'm marking this Manual Review Needed rather than approving, for two reasons. It changes how many findings a sink reports. And the open maintainer PR #799 rewrites the same functions with a different model for the same problem. The PIC should choose one before either lands.

Material findings

None blocking.

• Optional: behavioral_taint_tracking.py:661-676 emits one finding per distinct rule across a variable's sources, because _emit dedupes on (rule_id, node).

  • In the PR's own test, subprocess.run(command, shell=True) now reports both TT5 (CRITICAL, from input) and TT2 (MEDIUM, from os.getenv).
  • Similarly, a token read from os.getenv and later refreshed from requests.get reports both TT3 and TT2 at a requests.post sink.

  #750 allows either "the strongest applicable source" or "all of them". The PR body doesn't say which this implements, and the extra findings appear as new entries against existing baselines. Please state the choice in the PR body, and pin it in the test by asserting the full rule set at the sink, not just any(... == "TT5").

• Optional: add the network-sink counterpart #750 started from: a credential source and a network-input source reach requests.post, in both orders, and the test asserts TT3.

PIC tradeoffs

• Overlap with #799 ("scope taint to functions and bind call-site arguments"):
  • The two PRs conflict textually in behavioral_taint_tracking.py.
  • #799 replaces _collect_tainted and _mark_targets with a scoped graph. For each sink lane it keeps the most severe source, plus the first-arriving source for messages. It lists per-source fact sets as an approach it tried and dropped.
  • If #799 lands, this PR is superseded. If this lands first, #799 has to reconcile the dict-of-dicts shape.
  • The PIC should decide the reporting model: every source's rule (this PR) or the strongest rule per sink (#799).
• Cost. Work is now bounded by assignments × distinct source names, not by assignments alone. There are at most len(_ALL_SOURCES) source names, about 23. That is still linear in file size, but up to about 23 times main's worst case. The timing tests use a single source.

Verification and gaps

• I read the full diff and the head versions of _collect_tainted, _mark_targets, _find_tainted_names_in_args, _pick_rule and the sink loop in _analyze_python. I traced both orders of the new test, and the cyclic x/y/z test, by hand.
• Nothing outside this module consumes _collect_tainted, and deduplicate keeps findings with different rules separate.
• The new test fails on main for the getenv-then-input order: the first writer keeps os.getenv, so only TT2 is reported. The test therefore catches the regression.
• git merge-tree against current main is clean, GitHub reports MERGEABLE, and all 6 checks pass at 86e43cd. I didn't run the code or the tests.

[efegokdemir]

Closing this as superseded by #799, which merged on 14 October and addresses the same source-tracking issue.