Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/nytimes.py (Python)

Code before:
            'duration': 97,
        },
        'params': {
            # inconsistant md5
            'skip_download': True,
        },
    }, {
        # multiple videos in the same article
        'url': 'https://www.nytimes.com/2023/12/02/business/air-traffic-controllers-safety.html',
        'info_dict': {
            'id': 'air-traffic-controllers-safety',
            'title': 'Drunk and Asleep on the Job: Air Traffic Controllers Pushed to the Brink',
            'description': 'A nationwide shortage of controllers has resulted in an exhausted and demoralized work force that is increasingly prone to making dangerous mistakes.',
        },
        'playlist_count': 3,

    }, {
        'url': 'https://www.nytimes.com/2023/12/02/business/media/netflix-squid-game-challenge.html',
        'only_matching': True,
    }]

    def _real_extract(self, url):
        page_id = self._match_id(url)
        webpage = self._download_webpage(url, page_id).replace(':undefined', ':null')
        article_json = traverse_obj(self._search_json(
            r'window.__preloadedData\s=', webpage, 'media details', page_id), ('initialData', 'data', 'article'))
        blocks_json = traverse_obj(
            article_json, ('sprinkledBody', 'content', ..., ('ledeMedia', None), lambda _, v: v['__typename'] in ('Video', 'Audio')))

        art_title = remove_end(self._html_extract_title(webpage), ' - The New York Times')
        art_description = traverse_obj(
            article_json, ('sprinkledBody', 'content', ..., 'summary', 'content', ..., 'text'),
            get_all=False) or self._html_search_meta(['og:description', 'twitter:description'], webpage)
        creator = ', '.join(
            traverse_obj(article_json, ('bylines', ..., 'creators', ..., 'displayName'), get_all=True))

        # more than 1 video in the article, treat it as a playlist
        if len(blocks_json) > 1:
            entries = []
            for block_json in blocks_json:
                video_id = traverse_obj(block_json, ('sourceId'), get_all=False)
                media_title = traverse_obj(block_json, ('promotionalHeadline'), get_all=False) or art_title
                media_description = traverse_obj(block_json, ('summary'), get_all=False)
                uploader = traverse_obj(block_json, ('bylines', ..., 'renderedRepresentation'), get_all=False)
                duration = float_or_none(traverse_obj(block_json, ('duration'), get_all=False))
                publication_date = traverse_obj(block_json, ('firstPublished'))
                timestamp = parse_iso8601(publication_date) if publication_date else None

                media_content = traverse_obj(block_json, ('renditions', ...))
                formats, subtitles = self._extract_media_from_json(video_id, media_content)


Review comment (security):
- `article_json` can be fatal since we don't have anything to extract without it
- escape the dot and match any amount of whitespace before `=` in the pattern
- instead of replacing `:undefined` with `:null` when setting `webpage`, try `transform_source=js_to_json` in the `_search_json()` params, or else if necessary use `transform_source=lambda x: x.replace('undefined', 'null')`
```suggestion
        webpage = self._download_webpage(url, page_id)
        article_json = self._search_json(
            r'window\.__preloadedData\s*=', webpage, 'media details', page_id,
            transform_source=js_to_json)['initialData']['data']['article']
```

Code after:
                    'ext': ext,
                })

        return formats, subtitles

    def _extract_video(self, media_id):
        data = self._call_api(media_id)
        formats, subtitles = self._extract_formats_and_subtitles(media_id, data)

        return {
            'id': media_id,
            'title': data.get('promotionalHeadline'),
            'description': data.get('summary'),
            'duration': float_or_none(data.get('duration'), scale=1000),
            'creator': ', '.join(traverse_obj(data, (  # TODO: change to 'creators'
                'bylines', ..., 'renderedRepresentation', {lambda x: remove_start(x, 'By ')}))),
            'formats': formats,
            'subtitles': subtitles,
            'thumbnails': self._extract_thumbnails(
                traverse_obj(data, ('promotionalMedia', 'crops', ..., 'renditions', ...))),
        }


class NYTimesIE(NYTimesBaseIE):
    _VALID_URL = r'https?://(?:(?:www\.)?nytimes\.com/video/(?:[^/]+/)+?|graphics8\.nytimes\.com/bcvideo/\d+(?:\.\d+)?/iframe/embed\.html\?videoId=)(?P<id>\d+)'
    _EMBED_REGEX = [r'<iframe[^>]+src=(["\'])(?P<url>(?:https?:)?//graphics8\.nytimes\.com/bcvideo/[^/]+/iframe/embed\.html.+?)\1>']
    _TESTS = [{
        'url': 'http://www.nytimes.com/video/opinion/100000002847155/verbatim-what-is-a-photocopier.html?playlistId=100000001150263',
        'md5': 'a553aa344014e3723d33893d89d4defc',
        'info_dict': {
            'id': '100000002847155',
            'ext': 'mp4',
            'title': 'Verbatim: What Is a Photocopier?',
            'description': 'md5:93603dada88ddbda9395632fdc5da260',
            'timestamp': 1398631707,  # FIXME
            'upload_date': '20140427',  # FIXME
            'creator': 'Brett Weiner',
            'thumbnail': r're:https?://\w+\.nyt.com/images/.+\.jpg',
            'duration': 419,
        },
    }, {
        'url': 'http://www.nytimes.com/video/travel/100000003550828/36-hours-in-dubai.html',
        'only_matching': True,
    }]

    def _real_extract(self, url):
        video_id = self._match_id(url)

        return self._extract_video(video_id)