Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/caracoltv.py (Python)

Code before:
            r'<script[^>]+src\s*=\s*"([^"]+coreConfig.js[^"]+)', webpage, 'config js url', fatal=False)

        mediation_config = {} if not config_js_path else self._search_json(
            r'mediation\s*:', self._download_webpage(
                urljoin('https://play.caracoltv.com/', config_js_path), None, fatal=False, note='Extracting JS config'),
            'mediation_config', None, transform_source=js_to_json, fatal=False)

        key = traverse_obj(
            mediation_config, ('live', 'key')) or '795cd9c089a1fc48094524a5eba85a3fca1331817c802f601735907c8bbb4f50'
        secret = traverse_obj(
            mediation_config, ('live', 'secret')) or '64dec00a6989ba83d087621465b5e5d38bdac22033b0613b659c442c78976fa0'

        return base64.b64encode(f'{key}:{secret}'.encode()).decode()

    def _perform_login(self, email, password):
        webpage = self._download_webpage('https://play.caracoltv.com/', None, fatal=False)
        app_token = self._extract_app_token(webpage)

        bearer_token = self._download_json(
            'https://eu-gateway.inmobly.com/applications/oauth', None, data=b'', note='Retrieving bearer token',
            headers={'Authorization': f'Basic {app_token}'})['token']

        self._USER_TOKEN = self._download_json(
            'https://eu-gateway.inmobly.com/user/login', None, note='Performing login', headers={
                'Content-Type': 'application/json',
                'Authorization': 'Bearer' + bearer_token
            }, data=json.dumps({
                'device_data': {
                    'device_id': str(uuid.uuid4()),
                    'device_token': '',
                    'device_type': 'web'
                },
                'login_data': {
                    'enabled': True,
                    'email': email,
                    'password': password,
                }
            }).encode())['user_token']

    def _extract_video(self, video_data, series_id=None, season_id=None, season_number=None):
        formats, subtitles = self._extract_m3u8_formats_and_subtitles(video_data['stream_url'], series_id, 'mp4')

        return {
            'id': video_data['id'],
            'title': video_data.get('name'),
            'description': video_data.get('description'),
            'formats': formats,
            'subtitles': subtitles,
            'thumbnails': traverse_obj(
                video_data, ('extra_thumbs', ..., {'url': 'thumb_url', 'height': 'height', 'width': 'width'})),
            'series_id': series_id,

Review comment (security):
```suggestion
                'Authorization': f'Bearer {bearer_token}',
```

Code after:
            r'<script[^>]+src\s*=\s*"([^"]+coreConfig.js[^"]+)', webpage, 'config js url', fatal=False)

        mediation_config = {} if not config_js_path else self._search_json(
            r'mediation\s*:', self._download_webpage(
                urljoin('https://play.caracoltv.com/', config_js_path), None, fatal=False, note='Extracting JS config'),
            'mediation_config', None, transform_source=js_to_json, fatal=False)

        key = traverse_obj(
            mediation_config, ('live', 'key')) or '795cd9c089a1fc48094524a5eba85a3fca1331817c802f601735907c8bbb4f50'
        secret = traverse_obj(
            mediation_config, ('live', 'secret')) or '64dec00a6989ba83d087621465b5e5d38bdac22033b0613b659c442c78976fa0'

        return base64.b64encode(f'{key}:{secret}'.encode()).decode()

    def _perform_login(self, email, password):
        webpage = self._download_webpage('https://play.caracoltv.com/', None, fatal=False)
        app_token = self._extract_app_token(webpage)

        bearer_token = self._download_json(
            'https://eu-gateway.inmobly.com/applications/oauth', None, data=b'', note='Retrieving bearer token',
            headers={'Authorization': f'Basic {app_token}'})['token']

        self._USER_TOKEN = self._download_json(
            'https://eu-gateway.inmobly.com/user/login', None, note='Performing login', headers={
                'Content-Type': 'application/json',
                'Authorization': f'Bearer {bearer_token}',
            }, data=json.dumps({
                'device_data': {
                    'device_id': str(uuid.uuid4()),
                    'device_token': '',
                    'device_type': 'web'
                },
                'login_data': {
                    'enabled': True,
                    'email': email,
                    'password': password,
                }
            }).encode())['user_token']

    def _extract_video(self, video_data, series_id=None, season_id=None, season_number=None):
        formats, subtitles = self._extract_m3u8_formats_and_subtitles(video_data['stream_url'], series_id, 'mp4')

        return {
            'id': video_data['id'],
            'title': video_data.get('name'),
            'description': video_data.get('description'),
            'formats': formats,
            'subtitles': subtitles,
            'thumbnails': traverse_obj(
                video_data, ('extra_thumbs', ..., {'url': 'thumb_url', 'height': 'height', 'width': 'width'})),
            'series_id': series_id,