Reject subscription establishment if subscriber has no access

[mrjerryjohns]

Problem

See this spec issue.

Proposed Solution

Iterate over every expanded path in the SubscribeRequest and check if any of the paths have at least View privilege (this is already handled by calling RequiredPrivilege::ForReadAttribute(aPath)). If not a single path has that privilege, the subscription should not be established.

This processing should happen BEFORE we allocate a ReadHandler to serve the subscription. This ensures we don't tear down existing valid subscriptions to serve a subscription that is not valid.

[CamWms]

The spec does not have to be prescriptive about this. If an implementation can pre-check paths, and abort the subscription, great. The implementation may not be efficient in space by allocating a subscription to perform all checks, running out of space, and then aborting, even though the subscription is ultimately empty (because no privilege).

The available subscriptions are an MS setting anyway. If we want a concrete boundary on this, then we should assume the less efficient mechanism.

[woody-apple]

Cert Blocker Review: Looks like the spec issue is merged, and this is a security issue.

[andy31415]

V1 reivew: PR existed, needs reviving. Since this is a spec issue, it will be accepted in 1.0