diff --git a/src/cli/font.go b/src/cli/font.go index f52d502bf157..b3e44b51edd4 100644 --- a/src/cli/font.go +++ b/src/cli/font.go @@ -2,6 +2,7 @@ package cli import ( "fmt" + "strings" "github.com/jandedobbeleer/oh-my-posh/src/font" "github.com/jandedobbeleer/oh-my-posh/src/runtime" @@ -47,6 +48,10 @@ This command is used to install fonts and configure the font in your terminal. terminal.Init(env.Shell()) + if !strings.HasPrefix(zipFolder, "/") { + zipFolder += "/" + } + font.Run(fontName, env.Cache(), env.Root(), zipFolder) return diff --git a/src/font/install.go b/src/font/install.go index 673accdc92e6..d23c657c65f5 100644 --- a/src/font/install.go +++ b/src/font/install.go @@ -36,20 +36,19 @@ func InstallZIP(data []byte, m *main) ([]string, error) { fonts := make(map[string]*Font) - root := len(m.zipFolder) == 0 - for _, file := range zipReader.File { // prevent zipslip attacks // https://security.snyk.io/research/zip-slip-vulnerability - // and only process files which are in the specified folder - if strings.Contains(file.Name, "..") || !strings.HasPrefix(file.Name, m.zipFolder) { + // skip folders + if strings.Contains(file.Name, "..") || strings.HasSuffix(file.Name, "/") { continue } fontFileName := path.Base(file.Name) + fontRelativeFileName := strings.TrimPrefix(file.Name, m.zipFolder) - // do not install fonts that are not in the root folder when specified as such - if root && fontFileName != file.Name { + // do not install fonts that are not in the specified installation folder + if fontFileName != fontRelativeFileName { continue }