Current code will strip last char from the pathname entry, however it does not check to see if its actually a newline before doing so. This can result in files coming out with incorrect file extensions as the last letter is dropped. I did a hack to make it work for me, but this should definitely check to see if its a newline before dropping

--- pathname = pathname[:-1].decode("utf-8") #Remove the newling, and decode
+++ pathname = pathname.decode("utf-8") #Remove the newling, and decode

it doesn't run on win7 32bit any suggestion?

Problem:
Extraction will fail on Windows if some file in asset package includes nasty reserved character such as colon.

Expected:
Program should try to replace to safe character such as '_' rather than failure.

Additional comment:
This cruel asset provider is insane enough to include ':' (colon) in their filename inside package.
I'm on Windows 7.
The extraction will also fail in Unity Editor (tried with 2019) so I turned to 3rd party extractor to find some luck.
The project works great and I really like it. Extracting multiple big asset I bought become a tedious work until I found this great tool, thanks.
I could tinkle around the python script for myself but I will just let author know this issue too.

Having purchased "5000 fantasy icons" (536MB) I tried to extract it using your really neat program. This has worked very well on other packages, but on this one the terminal window opens (drag and drop method) but then sits there doing nothing. Is this a size limitation?

https://www.virustotal.com/gui/file/8ec0d3f2f0ed982a45a4d0d364f51c09a57a8ddd14dc3b3b0d66f2055bd30fb6/relations

the exe gets flagged as malicious, but not the source master when downloaded directly

pathname = f.readline() fails with UnicodeDecodeError if the text constains Japanese (or any other non-ascii character). I fixed it locally with with open(f"{assetEntryDir}/pathname", encoding='utf8') as f: but not sure if it's the best solution.

A specially crafted malicious .unitypackage can save or overwrite arbitrary files on the system when extracted with unitypackage_extractor due to several vulnerabilities. This could be used to install malware or overwrite important files.

tarfile.extractAll

Please note the warning in TarFile.extractall's docs: It doesn't ensure that files aren't created outside of the specified path. Here's a proof of concept:

touch /tmp/badfile
# Make a tarfile with an absolute path
tar -cf bad.tar -PC / /tmp/badfile
rm /tmp/badfile
python -c "import tarfile; tarfile.open('bad.tar').extractall('.')"
ls /tmp/badfile # It exists again!

When fixing this please keep in mind that tarfiles can also contain symlinks and other weird things. So maybe this approach might help to mitigate this issue.

No validation of "pathname" in .unitypackage

This very similar to the above. If a specially crafted .unitypackage has a modified pathname file in it that contains an absolute path, then the asset file will be moved to that location. This issue exists regardless of whether the user specifies an extraction output path or not, as os.path.join() will ignore its first argument when the second argument is an absolute path (tested on Windows and Linux).

As above the path should be validated. I don't think any valid .unitypackage will have absolute paths in it (in the tar itself, or in the pathfiles) so it would make sense to abort extraction if this is the case and inform the user.

Need to pass encoding="utf-8" to open(), since the file is UTF-8, but the default encoding on Windows isn't UTF-8 but region dependent, e.g. Windows-1252 or Windows-932 (on Japanese systems). Right now it'll read it with the wrong encoding because open() will default to the system/environment encoding setting, so the test fails.

I'm on Linux now, so gotta figure out how to build those x86 and x64 binaries for Windows. Cross-compile? Use an old Windows PC?

Hi, i wanted to know if it would be possible to have kind of a progression bar in the terminal window to show the user it haven't hanged up !
Thanks a lot !

Hello please include this in usage somewhere for ppl who have alot of packages and want to extract them quickly.

extractor in folder "unitypackage_extractor_64"
files will be outputted to "Extracted" folder
script need to be located in batch file in the folder where unitypackages are located
Recomended version is 1.0 cause of the "big packages freeze" bug

@echo off  
for /f "delims=" %%i in ('dir /b /a-d "*.unitypackage"') do (  
  echo Extracting started for - %%i  
  start unitypackage_extractor_64/extractor.exe "%%i" "Extracted"  
)

"Fatal Python error: initfsencoding: unable to load the file system codec
ModuleNotFoundError: No module named 'encodings'

Current thread 0x00004788 (most recent call first):"
this shows up for a few seconds after downloading and running, then the window auto closes
no matter what i run it from or to or how

The extractor doesn't work with this package:

https://download.bugsee.com/sdk/unity/BugseeUnity-stable.unitypackage

When I try to unpack unitypackage files I get the following:

any help?

> C:\Users\umutb\Downloads\unitypackage_extractor-x64>python -m unitypackage_extractor sounds.unitypackage
> Traceback (most recent call last):
>   File "C:\Python310\lib\runpy.py", line 196, in _run_module_as_main
>     return _run_code(code, main_globals, None,
>   File "C:\Python310\lib\runpy.py", line 86, in _run_code
>     exec(code, run_globals)
>   File "C:\Python310\lib\site-packages\unitypackage_extractor\__main__.py", line 5, in <module>
>     cli(sys.argv[1:])
>   File "C:\Python310\lib\site-packages\unitypackage_extractor\extractor.py", line 58, in cli
>     extractPackage(args[0], args[1] if len(args) > 1 else "")
>   File "C:\Python310\lib\site-packages\unitypackage_extractor\extractor.py", line 21, in extractPackage
>     with tarsafe.open(name=packagePath, encoding=encoding) as upkg:
>   File "C:\Python310\lib\site-packages\tarsafe\tarsafe.py", line 15, in open
>     return super().open(name, mode, fileobj, bufsize, **kwargs)
>   File "C:\Python310\lib\tarfile.py", line 1620, in open
>     raise ReadError(f"file could not be opened successfully:\n{error_msgs_summary}")
> tarfile.ReadError: file could not be opened successfully:
> - method gz: ReadError('not a gzip file')
> - method bz2: ReadError('not a bzip2 file')
> - method xz: ReadError('not an lzma file')
> - method tar: ReadError('invalid header')

Hi there, i am looking for a tool can extract information from ".exe" i just need to get which version of unity engine is using the binary executable (or if need extract from dll's).

You know a tool just for that, is the unique information i need to get from proyects maked from unity engine for microsoft windows.

Well thank you for any info you can share with me.

I've used this tool to decompress files, changed something, now I need to compress everything back. How can I achieve this?

Reported in #20 (comment) and can confirm

It looks like the extractor is hanging on large files (on the extracting portion specifically). A 330MB package takes 660 seconds (exe) and 864 seconds (python -m) vs 8 seconds in v1.0.0.

Workaround is to use v1.0.0 if you want it fast and trust your .unitypackage