Restrict Deno permissions by removing -A flag

Irene Alvarado · Irene Alvarado · commit 3038c00654b6 · 2021-05-20T13:26:48.000-04:00
diff --git a/dist/index.js b/dist/index.js
@@ -457,7 +457,7 @@ async function run() {
         core.startGroup('Postprocess');
         core.debug(`Invoking ${config.postprocess} with ${filename}...`);
         try {
-            const raw = child_process_1.execSync(`deno run -q -A --unstable ${config.postprocess} ${filename}`).toString();
+            const raw = child_process_1.execSync(`deno run -q --allow-read --allow-write --allow-run --allow-net --allow-env --unstable ${config.postprocess} ${filename}`).toString();
             core.info("Deno output:");
             core.info(raw);
         }
diff --git a/dist/index.js.map b/dist/index.js.map
diff --git a/src/main.ts b/src/main.ts
@@ -41,7 +41,7 @@ async function run(): Promise<void> {
     core.debug(`Invoking ${config.postprocess} with ${filename}...`)
     try {
       const raw = execSync(
-        `deno run -q -A --unstable ${config.postprocess} ${filename}`
+        `deno run -q --allow-read --allow-write --allow-run --allow-net --allow-env --unstable ${config.postprocess} ${filename}`
       ).toString()
 
       core.info("Deno output:")

Original file line number	Diff line number	Diff line change
`@@ -457,7 +457,7 @@ async function run() {`
`457`	`457`	`core.startGroup('Postprocess');`
`458`	`458`	core.debug(`Invoking ${config.postprocess} with ${filename}...`);
`459`	`459`	`try {`
`460`		- const raw = child_process_1.execSync(`deno run -q -A --unstable ${config.postprocess} ${filename}`).toString();
	`460`	+ const raw = child_process_1.execSync(`deno run -q --allow-read --allow-write --allow-run --allow-net --allow-env --unstable ${config.postprocess} ${filename}`).toString();
`461`	`461`	`core.info("Deno output:");`
`462`	`462`	`core.info(raw);`
`463`	`463`	`}`