Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/frontro.py (Python)

Code before:
import json

from .common import InfoExtractor
from ..utils import int_or_none, parse_iso8601, try_call, url_or_none
from ..utils.traversal import traverse_obj


class FrontoBaseIE(InfoExtractor):
    def _get_auth_headers(self, url):
        auth_cookie = try_call(lambda: self._get_cookies(url)['frAccessToken'].value)
        if not auth_cookie:
            return {}
        return {
            'authorization': f'Bearer {auth_cookie}',
        }


class FrontroVideoBaseIE(FrontoBaseIE):
    _CHANNEL_ID = None

    def _real_extract(self, url):
        video_id = self._match_id(url)

        metadata = self._download_json(
            'https://api.frontrow.cc/query', video_id, data=json.dumps({
                'operationName': 'Video',
                'variables': {'channelID': self._CHANNEL_ID, 'videoID': video_id},
                'query': '''query Video($channelID: ID!, $videoID: ID!) {
                    video(ChannelID: $channelID, VideoID: $videoID) {
                        ... on Video {title description updatedAt thumbnail createdAt duration likeCount comments views url hasAccess}
                    }
                }''',
            }).encode(), headers={
                'content-type': 'application/json',
                **self._get_auth_headers(url),
            })['data']['video']
        if not traverse_obj(metadata, 'hasAccess'):
            self.raise_login_required()

        formats, subtitles = self._extract_m3u8_formats_and_subtitles(metadata['url'], video_id)

Review comment (security):
```suggestion
        return traverse_obj(self._get_cookies(url), {
            'authorization': ('frAccessToken', 'value', {lambda token: f'Bearer {token}' if token else None}),
        })
```

Code after:
import json

from .common import InfoExtractor
from ..utils import int_or_none, parse_iso8601, url_or_none
from ..utils.traversal import traverse_obj


class FrontoBaseIE(InfoExtractor):
    def _get_auth_headers(self, url):
        return traverse_obj(self._get_cookies(url), {
            'authorization': ('frAccessToken', 'value', {lambda token: f'Bearer {token}' if token else None}),
        })


class FrontroVideoBaseIE(FrontoBaseIE):
    _CHANNEL_ID = None

    def _real_extract(self, url):
        video_id = self._match_id(url)

        metadata = self._download_json(
            'https://api.frontrow.cc/query', video_id, data=json.dumps({
                'operationName': 'Video',
                'variables': {'channelID': self._CHANNEL_ID, 'videoID': video_id},
                'query': '''query Video($channelID: ID!, $videoID: ID!) {
                    video(ChannelID: $channelID, VideoID: $videoID) {
                        ... on Video {title description updatedAt thumbnail createdAt duration likeCount comments views url hasAccess}
                    }
                }''',
            }).encode(), headers={
                'content-type': 'application/json',
                **self._get_auth_headers(url),
            })['data']['video']
        if not traverse_obj(metadata, 'hasAccess'):
            self.raise_login_required()

        formats, subtitles = self._extract_m3u8_formats_and_subtitles(metadata['url'], video_id)

        return {
            'id': video_id,