Quark doesn't detect that the output of first API is the input of the second API

Hi all, my friends (@Dil3mm3 and @ciastron) and I are working to implement new quark rules for a university semester project (our supervisor is @cryptax). We were analyzing Brazking malware (hash SHA256 be3d8500df167b9aaf21c5f76df61c466808b8fdf60e4a7da8d6057d476282b6, let us know if you want the sample).

We wrote this rule that gets the list of installed applications and put them in the shared preferences:
```
{
"crime": "Get installed applications and put the list in shared preferences",
"permission": [],
"api": [
{
"class": "Landroid/content/pm/PackageManager;",
"method": "getInstalledApplications",
"descriptor": "(I)Ljava/util/List;"
},
{
"class": "Landroid/content/SharedPreferences$Editor;",
"method": "putString",
"descriptor": "(Ljava/lang/String; Ljava/lang/String;)Landroid/content/SharedPreferences$Editor;"
}
],
"score": 1,
"label": [
"package manager",
"installed application",
"shared preferences"
]
}
```

In the malware sample cited before, this rule achieves 80%, but I think it should get 100%. I don't know if I'm wrong, for this reason I would like you to check with me.

In brazking malware, the rule is detected here:
```
List installedApplications = getPackageManager().getInstalledApplications(128);
StringBuilder sb = new StringBuilder();
for (ApplicationInfo applicationInfo : installedApplications) {
if ((1 & applicationInfo.flags) == 0) {
sb.append(applicationInfo.packageName);
sb.append(",");
}
}
// ...
Configuracoes.setString(this, "apps", sb.toString());
```

Where the method ```setString``` of ```Configuracoes``` is:
```
public static void setString(Context context, String str, String str2) {
SharedPreferences.Editor edit = context.getSharedPreferences(str, 0).edit();
edit.putString(str, str2);
edit.apply();
}
```

So, from the output of ```getInstalledApplications``` it is created a String Builder object, whose string is passed to ```setString``` and then input to ```putString``` (target of our rule).

If Quark implements tainted analysis, shouldn't it detect that the output of the first method is the input of the second, even if there is a String Builder in between? Or is it normal that it isn't detected?

I am using Quark **v21.3.2** .
Thank you!

Start by reproducing the rule from the issue against the cited Brazking sample using Quark v21.3.2. Trace the getInstalledApplications result through StringBuilder and Configuracoes.setString to putString, and determine whether this intermediate flow is supported. Done means clarifying or correcting the rule's taint-tracking behavior for this case.

Written by the indexing model from the issue text.