pass `TokenList` as reference into `ValueFlow::setValues()` by firewave · Pull Request #4868 · cppcheck-opensource/cppcheck

Okay - pointer to const objects are still allowed. That makes things just slightly better. But still being able to re-assign them in the class is dangerous. So to properly get a working const * const-like construct you would need some data class with accessors.

class C1
{
public:
    bool f() const;
};

class C2Data
{
protected:
    C2Data(const C1 &c1) : mC1(&c1) {}

    const C1 &c1() const { return *mC1; }
private:
    const C1 * mC1;
};

class C2 : public C2Data
{
public:
    C2(const C1 &c1) : C2Data(c1) {}
    bool f() {
        return c1().f();
    }
};

static void f()
{
    const C1 c1;
    C2 c2(c1);
}

Maybe you have to adjust the inheritance access but if I ever knew something about that I have forgotten it.

Still somebody would be able to do stupid things within C2Data. That would require some other check that tells you the data class is only there for storage and accessors.