Why is this query not detecting this sink

[akanksha1331]

/**
 * @name sink-detect-4
 * @kind problem
 * @problem.severity warnings
 * @id java/example/sink-detection
 */

 import java
 import semmle.code.java.dataflow.DataFlow
 
 predicate isSink(DataFlow::Node snk) {

   // Detect session management sinks
   exists(MethodAccess sessionUtils |
     sessionUtils.getMethod().getDeclaringType().getName() = "Utils" and
     (
       sessionUtils.getMethod().hasName("setSessionUserName") or
       sessionUtils.getMethod().hasName("setUsernameCookie")
     ) and
     snk.asExpr() = sessionUtils
   )
 }
 
 // Query to output each detected sink with its package, class, function declaration, and signature
 from DataFlow::Node sink
 where isSink(sink)
 select sink,
   "Sink element in type: " + sink.getEnclosingCallable().getDeclaringType().getName() + ", method: "
     + sink.getEnclosingCallable().getName() + ", signature: " +
     sink.getEnclosingCallable().getQualifiedName() + "(" +
     sink.getEnclosingCallable().getSignature() + ")" + ", sink data type: " +
     sink.getType().getName()
 

This is the sink I want to detect:

Utils.setUsernameCookie(response, result.getString("username"));

Context regarding this sink: This method directly uses the unvalidated username to set a cookie in the HTTP response headers, which could lead to HTTP Response Splitting if CR/LF characters are included and not properly handled.
If the username contains CR (\r) and LF (\n) characters, it could potentially inject malicious headers into the HTTP response if the application server did not sanitize these characters.

The above query doesnt give any results.
How can I change this query so it detects this sink?

[aibaars]

Have you tried debugging your query with the CodeQL: Quick evaluation feature? In the VScode IDE, select a piece of QL code you'd like to inspect, right-click and choose CodeQL: Quick evaluation.

First investigate the isSink predicate:

• select the word MethodAccess in the editor and quick evaluate, this gives you a list of all method access in the code (possibly quite a lot)
• select the fragment sessionUtils.getMethod().getDeclaringType().getName() = "Utils" in the editor and quick evaluate. This should give you all the accesses to methods defined in classes named "Utils"
• carry on restricting things until no results are reported. Most likely the last restriction you included is somehow wrong (or the QL database you are analyzing does not contain what you are looking for).

If the isSink predicate is working as expected, repeat the above steps for the select statement.

See also: https://docs.github.com/en/code-security/codeql-for-vs-code/getting-started-with-codeql-for-vs-code/running-codeql-queries#running-a-specific-part-of-a-query-or-library