Unable to Detect Path

[akanksha1331]

This is my CodeQL query which detects path/

/**
 * @kind path-problem
 * @name 502path
 * @id java/example/path-detection
 */

import semmle.code.java.dataflow.TaintTracking

module MyFlowConfiguration implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node src) {
    exists(Parameter p |
      p.getName() in ["req"] and
      src.asParameter() = p
    )
  }

  predicate isSink(DataFlow::Node snk) {
    exists(ConstructorCall c |
      c.getConstructor().getDeclaringType().hasQualifiedName("java.io", "ObjectInputStream") and
      snk.asExpr() = c.getAnArgument()
    )
  }
}

module Flow = TaintTracking::Global<MyFlowConfiguration>;

import Flow::PathGraph

from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, ""

This is the code snippet whose path I want to detect
The source is HttpServletRequest req
the sink is argument to ObjectInputStream()

private static final String COOKIE_NAME = "user";
public static User createFromRequest(HttpServletRequest req) {
		Cookie cookie = getCookieFromRequestByName(req, COOKIE_NAME);

		InputStream stream = new ByteArrayInputStream(cookie.getValue().getBytes(StandardCharsets.UTF_8));
		InputStream decodedstream = Base64.getDecoder().wrap(stream);
		ObjectInputStream in;
		try {
			
			in = new ObjectInputStream(decodedstream);
			User user = (User) in.readObject();
			in.close();
			

			return user;

		}
.....
]

The above query is not able to detect path between the source and sink.
On using quick evaluation, the source and sink are being found independently.
Can anyone help me understand why?

[hvitved]

How is getCookieFromRequestByName defined? Assuming we are able to detect taint flow from req to the result of calling getCookieFromRequestByName, there is still a lot of steps that need to be modeled, which I don't know whether they are (getValue(), getBytes, and wrap).