Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/hrfensehen.py (Python)

Code before:
                'url': inner['url'],
            }

            quality_information = re.search(r'([0-9]{3,4})x([0-9]{3,4})-([0-9]{2})p-([0-9]{3,4})kbit',
                                            inner['url'])
            if quality_information:
                stream_format['width'] = int_or_none(quality_information.group(1))
                stream_format['height'] = int_or_none(quality_information.group(2))
                stream_format['fps'] = int_or_none(quality_information.group(3))
                stream_format['tbr'] = int_or_none(quality_information.group(4))

            stream_formats.append(stream_format)

        self._sort_formats(stream_formats)
        return stream_formats

    def _real_extract(self, url):
        video_id = self._match_id(url)
        webpage = self._download_webpage(url, video_id)

        title = self._html_search_meta(
            ['og:title', 'twitter:title', 'name'], webpage)
        description = self._html_search_meta(
            ['description'], webpage)

        loader_str = unescapeHTML(self._search_regex(r"data-(?:new-)?hr-mediaplayer-loader='([^']*)'", webpage, "ardloader"))
        loader_data = json.loads(loader_str)

        subtitle = traverse_obj(loader_data, ('mediaCollection', 'subTitles', 0, 'sources', 0, 'url'))

        datetime = self._search_regex(r'<time\sdatetime=\"(\d{4}\W\d{1,2}\W\d{1,2})', webpage, 'datetime', fatal=False)
        timestamp = unified_timestamp(datetime)

        duration = int_or_none(traverse_obj(loader_data, ('playerConfig', 'pluginData', 'trackingAti@all', 'richMedia', 'duration')))
        # info['duration'] = int_or_none(duration)

        thumbnail = self._search_regex(r'(thumbnailUrl\W*)([^\"]*)', webpage, 'thumbnail', group=2, default=None)

        info = {
            'id': video_id,
            'title': title,
            'description': description,
            'formats': self.extract_formats(loader_data),
            'subtitles': {'de': [{'url': subtitle}]},
            'timestamp': timestamp,
            'duration': duration,
            'thumbnail': thumbnail,
        }

        return info


Review comment (security):
```suggestion
        loader_str = unescapeHTML(self._search_regex(r"data-(?:new-)?hr-mediaplayer-loader='([^']*)'", webpage, 'ardloader'))
```

Code after:
        stream_formats = []
        data = loader_data['mediaCollection']['streams'][0]['media']
        for inner in data[1:]:
            stream_format = {
                'format_id': try_call(lambda: f'{inner["maxHResolutionPx"]}p'),
                'height': inner.get('maxHResolutionPx'),
                'url': inner['url'],
            }

            quality_information = re.search(r'([0-9]{3,4})x([0-9]{3,4})-([0-9]{2})p-([0-9]{3,4})kbit',
                                            inner['url'])
            if quality_information:
                stream_format['width'] = int_or_none(quality_information.group(1))
                stream_format['height'] = int_or_none(quality_information.group(2))
                stream_format['fps'] = int_or_none(quality_information.group(3))
                stream_format['tbr'] = int_or_none(quality_information.group(4))

            stream_formats.append(stream_format)

        self._sort_formats(stream_formats)
        return stream_formats

    def _real_extract(self, url):
        video_id = self._match_id(url)
        webpage = self._download_webpage(url, video_id)

        title = self._html_search_meta(
            ['og:title', 'twitter:title', 'name'], webpage)
        description = self._html_search_meta(
            ['description'], webpage)

        loader_str = unescapeHTML(self._search_regex(r"data-(?:new-)?hr-mediaplayer-loader='([^']*)'", webpage, 'ardloader'))
        loader_data = json.loads(loader_str)

        subtitle = traverse_obj(loader_data, ('mediaCollection', 'subTitles', 0, 'sources', 0, 'url'))

        info = {
            'id': video_id,
            'title': title,
            'description': description,
            'formats': self.extract_formats(loader_data),
            'subtitles': {'de': [{'url': subtitle}]},
            'timestamp': unified_timestamp(self._search_regex(
                r'<time\sdatetime="(\d{4}\W\d{1,2}\W\d{1,2})', webpage, 'datetime', fatal=False)),
            'duration': int_or_none(traverse_obj(
                loader_data, ('playerConfig', 'pluginData', 'trackingAti@all', 'richMedia', 'duration'))),
            'thumbnail': self._search_regex(r'thumbnailUrl\W*([^"]+)', webpage, 'thumbnail', default=None),
        }

        return info