Add model validation for constructor summary models

Author: owen-mc

java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

@@ -375,6 +375,18 @@ module ModelValidation {
         KindVal::getInvalidModelKind()
       ]
   }
+
+  query predicate getIncorrectConstructorSummaryModel(string msg) {
+    exists(string namespace, string type, string name, string output |
+      summaryModel(namespace, type, _, name, _, _, _, output, _, _, _)
+    |
+      type = name and
+      output.matches("ReturnValue%") and
+      msg =
+        "Constructor model for " + namespace + "." + type +
+          " should use `Argument[this]` in the output, not `ReturnValue`."
+    )
+  }
 }
 
 pragma[nomagic]

java/ql/test/library-tests/dataflow/external-models/validatemodels.expected

@@ -0,0 +1,11 @@
+invalidModelRow
+getIncorrectConstructorSummaryModel
+| Constructor model for java.net.URI should use `Argument[this]` in the output, not `ReturnValue`. |
+| Constructor model for java.util.zip.ZipEntry should use `Argument[this]` in the output, not `ReturnValue`. |
+| Constructor model for org.apache.hc.core5.http.io.entity.BasicHttpEntity should use `Argument[this]` in the output, not `ReturnValue`. |
+| Constructor model for org.apache.hc.core5.http.io.entity.BufferedHttpEntity should use `Argument[this]` in the output, not `ReturnValue`. |
+| Constructor model for org.apache.hc.core5.http.io.entity.HttpEntityWrapper should use `Argument[this]` in the output, not `ReturnValue`. |
+| Constructor model for org.apache.hc.core5.http.io.entity.InputStreamEntity should use `Argument[this]` in the output, not `ReturnValue`. |
+| Constructor model for org.apache.http.entity.BufferedHttpEntity should use `Argument[this]` in the output, not `ReturnValue`. |
+| Constructor model for org.apache.http.entity.HttpEntityWrapper should use `Argument[this]` in the output, not `ReturnValue`. |
+| Constructor model for org.apache.http.entity.InputStreamEntity should use `Argument[this]` in the output, not `ReturnValue`. |