Python: Don't make duplicate sink for Tornado handler

`self.write(...)` would be treated as *both* TornadoConnectionWrite and
TornadoHttpRequestHandlerWrite

Author: RasmusWL

python/ql/src/semmle/python/web/tornado/Response.qll

@@ -24,11 +24,8 @@ class TornadoConnectionWrite extends HttpResponseTaintSink {
     TornadoConnectionWrite() {
         exists(CallNode call, ControlFlowNode conn |
             conn = call.getFunction().(AttrNode).getObject("write") and
-            this = call.getAnArg()
-        |
+            this = call.getAnArg() and
             exists(TornadoConnection tc | tc.taints(conn))
-            or
-            isTornadoRequestHandlerInstance(conn)
         )
     }
 
@@ -41,8 +38,8 @@ class TornadoHttpRequestHandlerWrite extends HttpResponseTaintSink {
     TornadoHttpRequestHandlerWrite() {
         exists(CallNode call, ControlFlowNode node |
             node = call.getFunction().(AttrNode).getObject("write") and
-            isTornadoRequestHandlerInstance(node) and
-            this = call.getAnArg()
+            this = call.getAnArg() and
+            isTornadoRequestHandlerInstance(node)
         )
     }
 

python/ql/test/library-tests/web/tornado/HttpSinks.expected

@@ -1,8 +1,4 @@
 | test.py:6:20:6:43 | tornado.HttpRequesHandler.write | externally controlled string |
-| test.py:6:20:6:43 | tornado.connection.write | externally controlled string |
 | test.py:12:20:12:23 | tornado.HttpRequesHandler.write | externally controlled string |
-| test.py:12:20:12:23 | tornado.connection.write | externally controlled string |
 | test.py:20:23:20:25 | tornado.HttpRequesHandler.redirect | externally controlled string |
 | test.py:26:20:26:48 | tornado.HttpRequesHandler.write | externally controlled string |
-| test.py:26:20:26:48 | tornado.connection.write | externally controlled string |
-FIXME