Java: cover wrapped constructor taint flow

Author: tamasvajk

java/ql/src/semmle/code/java/dataflow/ExternalFlow.qll

@@ -697,3 +697,15 @@ predicate summaryStep(Node node1, Node node2, string kind) {
     interpretOutput(output, 0, ref, TNode(node2))
   )
 }
+
+/**
+ * Holds if `node1` to `node2` is specified as a flow step with the given kind, input and output
+ * in a CSV flow model.
+ */
+predicate summaryStep(Node node1, Node node2, string kind, string input, string output) {
+  exists(Top ref |
+    summaryElementRef(ref, input, output, kind) and
+    interpretInput(input, 0, ref, TNode(node1)) and
+    interpretOutput(output, 0, ref, TNode(node2))
+  )
+}

java/ql/src/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

@@ -166,6 +166,9 @@ private predicate inputStreamWrapper(Constructor c, int argi) {
 /** An object construction that preserves the data flow status of any of its arguments. */
 private predicate constructorStep(Expr tracked, ConstructorCall sink) {
   exists(int argi | sink.getArgument(argi) = tracked |
+    summaryStep(any(DataFlow::Node n | n.asExpr() = tracked),
+      any(DataFlow::Node n | n.asExpr() = sink), "taint", "Argument(" + argi + ")", "ReturnValue")
+    or
     // wrappers constructed by extension
     exists(Constructor c, Parameter p, SuperConstructorInvocationStmt sup |
       c = sink.getConstructor() and