Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/cbc.py (Python)

Code before:
                url = re.sub('(Manifest\\(.*?),format=[\\w-]+(.*?\\))', '\\1\\2', base_url)
                base_f = copy.deepcopy(f)
                break

        # Download and parse the secret xml
        secret_xml = self._download_xml(url, video_id, note='Downloading secret XML', fatal=False)
        if not secret_xml:
            return

        # Build all video formats from the xml
        for child in secret_xml:
            if child.attrib.get('Type') == 'video':
                for video_quality in child:
                    if 'Index' not in video_quality.attrib:
                        continue
                    width = int(video_quality.attrib['MaxWidth'])
                    height = int(video_quality.attrib['MaxHeight'])
                    bitrate = int(video_quality.attrib['Bitrate'])

                    new_f = copy.deepcopy(base_f)
                    new_f['format_id'] = f"sec-{height}"
                    new_f['url'] = re.sub('(QualityLevels\\()\\d+(\\))', f'\\g<1>{bitrate}\\2', base_url)
                    new_f['tbr'] = bitrate / 1000.0
                    new_f['width'] = width
                    new_f['height'] = height
                    formats.append(new_f)

    def _real_extract(self, url):
        video_id = self._match_id(url)
        video_info = self._download_json('https://services.radio-canada.ca/ott/cbc-api/v2/assets/' + video_id, video_id)

        email, password = self._get_login_info()
        if email and password:
            claims_token = self._get_claims_token(email, password)
            headers = {'x-claims-token': claims_token}
        else:
            headers = {}
        m3u8_info = self._download_json(video_info['playSession']['url'], video_id, headers=headers)
        m3u8_url = m3u8_info.get('url')

        if m3u8_info.get('errorCode') == 1:
            self.raise_geo_restricted(countries=['CA'])
        elif m3u8_info.get('errorCode') == 35:
            self.raise_login_required(method='password')
        elif m3u8_info.get('errorCode') != 0:
            raise ExtractorError(f'{self.IE_NAME} said: {m3u8_info.get("errorCode")} - {m3u8_info.get("message")}')

        formats = self._extract_m3u8_formats(m3u8_url, video_id, m3u8_id='hls')
        self._remove_duplicate_formats(formats)
        self._find_secret_formats(formats, video_id)


Review comment (security):
```suggestion
        """ Find a valid video url and convert it to the secret variant """
        base_format = next((f for f in formats if f.get('height')), None)
        if not base_format:
            return

        base_url = re.sub(r'(Manifest\(.*?),filter=[\w-]+(.*?\))', r'\1\2', base_format['url'])
        url = re.sub(r'(Manifest\(.*?),format=[\w-]+(.*?\))', r'\1\2', base_url)

        secret_xml = self._download_xml(url, video_id, note='Downloading secret XML', fatal=False)
        if not secret_xml:
            return

        for child in secret_xml:
            if child.attrib.get('Type') != 'video':
                continue
            for video_quality in child:
                bitrate = int_or_none(video_quality.attrib.get('Bitrate'))
                if not bitrate or 'Index' not in video_quality.attrib:
                    continue
                height = int_or_none(video_quality.attrib.get('MaxHeight'))

                yield {
                    **base_format,
                    'format_id': join_nonempty('sec', height),
                    'url': re.sub(r'(QualityLevels\()\d+(\))', fr'\1{bitrate}\2', base_url)
                    'width': int_or_none(video_quality.attrib.get('MaxWidth')),
                    'tbr': bitrate / 1000.0,
                    'height': height
                }
```

Code after:
        url = re.sub(r'(Manifest\(.*?),format=[\w-]+(.*?\))', r'\1\2', base_url)

        secret_xml = self._download_xml(url, video_id, note='Downloading secret XML', fatal=False)
        if not secret_xml:
            return

        for child in secret_xml:
            if child.attrib.get('Type') != 'video':
                continue
            for video_quality in child:
                bitrate = int_or_none(video_quality.attrib.get('Bitrate'))
                if not bitrate or 'Index' not in video_quality.attrib:
                    continue
                height = int_or_none(video_quality.attrib.get('MaxHeight'))

                yield {
                    **base_format,
                    'format_id': join_nonempty('sec', height),
                    'url': re.sub(r'(QualityLevels\()\d+(\))', fr'\<1>{bitrate}\2', base_url),
                    'width': int_or_none(video_quality.attrib.get('MaxWidth')),
                    'tbr': bitrate / 1000.0,
                    'height': height,
                }

    def _real_extract(self, url):
        video_id = self._match_id(url)
        video_info = self._download_json('https://services.radio-canada.ca/ott/cbc-api/v2/assets/' + video_id, video_id)

        email, password = self._get_login_info()
        if email and password:
            claims_token = self._get_claims_token(email, password)
            headers = {'x-claims-token': claims_token}
        else:
            headers = {}
        m3u8_info = self._download_json(video_info['playSession']['url'], video_id, headers=headers)
        m3u8_url = m3u8_info.get('url')

        if m3u8_info.get('errorCode') == 1:
            self.raise_geo_restricted(countries=['CA'])
        elif m3u8_info.get('errorCode') == 35:
            self.raise_login_required(method='password')
        elif m3u8_info.get('errorCode') != 0:
            raise ExtractorError(f'{self.IE_NAME} said: {m3u8_info.get("errorCode")} - {m3u8_info.get("message")}')

        formats = self._extract_m3u8_formats(m3u8_url, video_id, m3u8_id='hls')
        self._remove_duplicate_formats(formats)
        formats.extend(self._find_secret_formats(formats, video_id))

        for format in formats:
            if format.get('vcodec') == 'none':
                if format.get('ext') is None: