Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/tumblr.py (Python)

Code before:
    def _real_extract(self, url):
        blog, video_id = self._match_valid_url(url).groups()

        url = f'http://{blog}.tumblr.com/post/{video_id}/'
        webpage, urlh = self._download_webpage_handle(url, video_id)

        redirect_url = urlh.geturl()

        api_only = bool(self._search_regex(
            r'(tumblr.com|^)/(safe-mode|login_required|blog/view)',
            redirect_url, 'redirect', default=None))

        if api_only and not self._ACCESS_TOKEN:
            raise ExtractorError('Cannot get data for dashboard-only post without access token')

        post_json = {}
        if self._ACCESS_TOKEN:
            post_json = traverse_obj(
                self._download_json(
                    f'https://www.tumblr.com/api/v2/blog/{blog}/posts/{video_id}/permalink',
                    video_id,
                    headers={
                        'Authorization': f'Bearer {self._ACCESS_TOKEN}',
                    },
                    fatal=False),
                ('response', 'timeline', 'elements', 0), default={})
        content_json = traverse_obj(
            post_json, ('trail', 0, 'content'), ('content'), default=[])
        video_json = next(
            (item for item in content_json if item.get('type') == 'video'),
            {})
        media_json = video_json.get('media') or {}
        if api_only and 'url' not in media_json and 'url' not in video_json:
            raise ExtractorError('Failed to find video data for dashboard-only post')

        if 'url' not in media_json and 'url' in video_json:
            # external video host
            return self.url_result(
                video_json['url'],
                self._providers.get(video_json.get('provider'), 'Generic'))

        video_url = self._og_search_video_url(webpage, default=None)
        duration = None
        formats = []

        # iframes can supply duration and sometimes additional formats, so check for one
        iframe_url = self._search_regex(
            fr'src=\'(https?://www\.tumblr\.com/video/{blog}/{video_id}/[^\']+)\'',
            webpage, 'iframe url', default=None)
        if iframe_url:
            iframe = self._download_webpage(

Review comment (security):
```suggestion
            post_json = traverse_obj(
                self._download_json(
                    f'https://www.tumblr.com/api/v2/blog/{blog}/posts/{video_id}/permalink',
                    video_id, headers={'Authorization': f'Bearer {self._ACCESS_TOKEN}'}, fatal=False),
                ('response', 'timeline', 'elements', 0)) or {}
```

Code after:
            errnote='Login failed', fatal=False)

    def _real_extract(self, url):
        blog, video_id = self._match_valid_url(url).groups()

        url = f'http://{blog}.tumblr.com/post/{video_id}/'
        webpage, urlh = self._download_webpage_handle(url, video_id)

        redirect_url = urlh.geturl()

        api_only = bool(self._search_regex(
            r'(tumblr.com|^)/(safe-mode|login_required|blog/view)',
            redirect_url, 'redirect', default=None))

        if api_only and not self._ACCESS_TOKEN:
            raise ExtractorError('Cannot get data for dashboard-only post without access token')

        post_json = {}
        if self._ACCESS_TOKEN:
            post_json = traverse_obj(
                self._download_json(
                    f'https://www.tumblr.com/api/v2/blog/{blog}/posts/{video_id}/permalink',
                    video_id, headers={'Authorization': f'Bearer {self._ACCESS_TOKEN}'}, fatal=False),
                ('response', 'timeline', 'elements', 0)) or {}
        content_json = traverse_obj(post_json, ('trail', 0, 'content'), ('content')) or []
        video_json = next(
            (item for item in content_json if item.get('type') == 'video'), {})
        media_json = video_json.get('media') or {}
        if api_only and not media_json.get('url') and not video_json.get('url'):
            raise ExtractorError('Failed to find video data for dashboard-only post')

        if not media_json.get('url') and video_json.get('url'):
            # external video host
            return self.url_result(
                video_json['url'],
                self._providers.get(video_json.get('provider'), 'Generic'))

        video_url = self._og_search_video_url(webpage, default=None)
        duration = None
        formats = []

        # iframes can supply duration and sometimes additional formats, so check for one
        iframe_url = self._search_regex(
            fr'src=\'(https?://www\.tumblr\.com/video/{blog}/{video_id}/[^\']+)\'',
            webpage, 'iframe url', default=None)
        if iframe_url:
            iframe = self._download_webpage(
                iframe_url, video_id, 'Downloading iframe page',
                headers={'Referer': redirect_url})

            options = self._parse_json(