C++: fix constructor models

Author: Robert Marsh

cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll

@@ -38,9 +38,11 @@ class StdSequenceContainerConstructor extends Constructor, TaintFunction {
       input.isParameterDeref(getAValueTypeParameterIndex()) or
       input.isParameter(getAnIteratorParameterIndex())
     ) and
-    output.isReturnValue()
-    or
-    output.isQualifierObject()
+    (
+      output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
+      or
+      output.isQualifierObject()
+    )
   }
 }
 

cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll

@@ -48,7 +48,7 @@ class StdStringConstructor extends Constructor, TaintFunction {
       input.isParameter(getAnIteratorParameterIndex())
     ) and
     (
-      output.isReturnValue()
+      output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
       or
       output.isQualifierObject()
     )
@@ -383,9 +383,11 @@ class StdStringStreamConstructor extends Constructor, TaintFunction {
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // taint flow from any parameter of string type to the returned object
     input.isParameterDeref(getAStringParameterIndex()) and
-    output.isReturnValue()
-    or
-    output.isQualifierObject()
+    (
+      output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
+      or
+      output.isQualifierObject()
+    )
   }
 }