fix(font): only install from the specified folder

src/cli/font.go

@@ -2,6 +2,7 @@ package cli
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/jandedobbeleer/oh-my-posh/src/font"
 	"github.com/jandedobbeleer/oh-my-posh/src/runtime"
@@ -47,6 +48,10 @@ This command is used to install fonts and configure the font in your terminal.
 
 				terminal.Init(env.Shell())
 
+				if !strings.HasPrefix(zipFolder, "/") {
+					zipFolder += "/"
+				}
+
 				font.Run(fontName, env.Cache(), env.Root(), zipFolder)
 
 				return

src/font/install.go

@@ -36,20 +36,19 @@ func InstallZIP(data []byte, m *main) ([]string, error) {
 
 	fonts := make(map[string]*Font)
 
-	root := len(m.zipFolder) == 0
-
 	for _, file := range zipReader.File {
 		// prevent zipslip attacks
 		// https://security.snyk.io/research/zip-slip-vulnerability
-		// and only process files which are in the specified folder
-		if strings.Contains(file.Name, "..") || !strings.HasPrefix(file.Name, m.zipFolder) {
+		// skip folders
+		if strings.Contains(file.Name, "..") || strings.HasSuffix(file.Name, "/") {
 			continue
 		}
 
 		fontFileName := path.Base(file.Name)
+		fontRelativeFileName := strings.TrimPrefix(file.Name, m.zipFolder)
 
-		// do not install fonts that are not in the root folder when specified as such
-		if root && fontFileName != file.Name {
+		// do not install fonts that are not in the specified installation folder
+		if fontFileName != fontRelativeFileName {
 			continue
 		}