[dataflowengineoss] Fix missing taint nodes on conditional operator

[d1tto]

Take the code as an example

<?= isset($_GET['added_after']) ? htmlspecialchars($_GET['added_after']) : '' ?>

the expected taint flow is

• $_GET['added_after']
• htmlspecialchars($_GET['added_after']) // missing in current joern
• isset($_GET['added_after']) ? htmlspecialchars($_GET['added_after']) : ''
• echo isset($_GET['added_after']) ? htmlspecialchars($_GET['added_after']) : ''

However, due to the incomplete semantics for conditional, the htmlspecialchars($_GET['added_after']) call node is marked as invisible in here:

// Engine.scala
  private def elemForEdge(e: Edge, callSiteStack: List[Call] = List(), strict: Boolean)(implicit
    semantics: Semantics
  ): Option[PathElement] = {
    // in this case, 
    // curNode is `isset($_GET['added_after']) ? htmlspecialchars($_GET['added_after']) : ''`
    // parNode is `htmlspecialchars($_GET['added_after'])`
    curNode match {
      // ...
      case childNode: Expression =>
        parNode match {
          case parentNode: Expression =>
            val parentNodeCall = parentNode.inCall.l
            val sameCallSite   = parentNode.inCall.l == childNode.start.inCall.l
            val visible = if (sameCallSite) {
              // ...
            } else {
              parentNode.isDefined // here
            }
            // ...
        }
    }
  }