Add one case I think was missing - NSUserActivity.referrerURL. @atorralba do you agree with this change or was it left our for a reason?

Hm, let's see. The NSUserActivity.webpageURL taint step was meant to represent that tainted data comes from the WebView when the user navigates to a website (i.e. they maybe clicked on a malicious link with a tainted URL).

If we consider that referrerURL also propagates taint, this means that the user isn't navigating to a malicious website, but rather from a malicious website (and even then, I'm not sure how much of the referrerURL an attacker is able to control, unless they also control the link that brought the user to their webpage).

So in a sense, controlling webpageURL seems like a prerequisite to controlling referrerURL. Having said that, there could be cases where this condition is met, but webpageURL doesn't flow to any sink whereas referrerURL does.

This means that this is a valid and useful taint step (thanks for catching it!), but may lead to some FPs when the navigation occurs from a trusted page, which I think we have no way of knowing statically (similarly to how we can't know whether the clicked link was under an attacker's control).