Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/instagram.py (Python)

Code before:
                fatal=False, errnote=False, note='Downloading video info', headers={
                    **self._API_HEADERS
                }), ('items', 0))
            if info:
                media.update(info)
                comments_info = self._download_json(
                    f'{self._API_BASE_URL}/media/{_id_to_pk(video_id)}/comments/?can_support_threading=true&permalink_enabled=false', video_id,
                    fatal=False, errnote=False, note='Downloading comments info', headers={
                        **self._API_HEADERS
                    }) or {}
                media.update(comments_info)
                return self._extract_product(media)

        api_check = self._download_json(
            f'{self._API_BASE_URL}/web/get_ruling_for_content/?content_type=MEDIA&target_id={_id_to_pk(video_id)}',
            video_id, headers=self._API_HEADERS, fatal=False, note='Setting up session', errnote=False) or {}
        csrf_token = self._get_cookies('https://www.instagram.com').get('csrftoken')

        if not csrf_token:
            self.report_warning('No csrf token set by Instagram API', video_id)
            csrf_token_value = ''
        elif api_check.get('status') != 'ok':
            self.report_warning('Instagram API is not granting access', video_id)
            csrf_token_value = ''
        else:
            csrf_token_value = csrf_token.value

        variables = {
            'shortcode': video_id,
            'child_comment_count': 3,
            'fetch_comment_count': 40,
            'parent_comment_count': 24,
            'has_threaded_comments': True,
        }
        general_info = self._download_json(
            'https://www.instagram.com/graphql/query/', video_id, fatal=False, errnote=False,
            headers={
                **self._API_HEADERS,
                'X-CSRFToken': csrf_token_value,
                'X-Requested-With': 'XMLHttpRequest',
                'Referer': url,
            }, query={
                'query_hash': '9f8827793ef34641b2fb195d4d41151c',
                'variables': json.dumps(variables, separators=(',', ':')),
            })
        media.update(traverse_obj(general_info, ('data', 'shortcode_media')) or {})

        if not general_info:
            self.report_warning('General metadata extraction failed (some metadata might be missing).', video_id)
            webpage, urlh = self._download_webpage_handle(url, video_id)
            shared_data = self._search_json(

Review comment (security):
```py
        if not csrf_token:
            self.report_warning('No csrf token set by Instagram API', video_id)
        else:
            csrf_token = csrf_token.value if api_check.get('status') == 'ok' else None
            if not csrf_token:
                self.report_warning('Instagram API is not granting access', video_id)
            
```

Code after:
    }, {
        'url': 'https://www.instagram.com/tv/aye83DjauH/',
        'only_matching': True,
    }, {
        'url': 'https://www.instagram.com/reel/CDUMkliABpa/',
        'only_matching': True,
    }, {
        'url': 'https://www.instagram.com/marvelskies.fc/reel/CWqAgUZgCku/',
        'only_matching': True,
    }]

    @classmethod
    def _extract_embed_urls(cls, url, webpage):
        res = tuple(super()._extract_embed_urls(url, webpage))
        if res:
            return res

        mobj = re.search(r'<a[^>]+href=([\'"])(?P<link>[^\'"]+)\1',
                         get_element_by_attribute('class', 'instagram-media', webpage) or '')
        if mobj:
            return [mobj.group('link')]

    def _real_extract(self, url):
        video_id, url = self._match_valid_url(url).group('id', 'url')
        media, webpage = {}, ''

        if self._get_cookies(url).get('sessionid'):
            info = traverse_obj(self._download_json(
                f'{self._API_BASE_URL}/media/{_id_to_pk(video_id)}/info/', video_id,
                fatal=False, errnote='Video info extraction failed',
                note='Downloading video info', headers=self._API_HEADERS), ('items', 0))
            if info:
                media.update(info)
                return self._extract_product(media)

        api_check = self._download_json(
            f'{self._API_BASE_URL}/web/get_ruling_for_content/?content_type=MEDIA&target_id={_id_to_pk(video_id)}',
            video_id, headers=self._API_HEADERS, fatal=False, note='Setting up session', errnote=False) or {}
        csrf_token = self._get_cookies('https://www.instagram.com').get('csrftoken')

        if not csrf_token:
            self.report_warning('No csrf token set by Instagram API', video_id)
        else:
            csrf_token = csrf_token.value if api_check.get('status') == 'ok' else None
            if not csrf_token:
                self.report_warning('Instagram API is not granting access', video_id)

        variables = {
            'shortcode': video_id,
            'child_comment_count': 3,
            'fetch_comment_count': 40,