Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/triller.py (Python)

Code before:
        if not login.get('auth_token'):
            if login.get('error') == 1008:
                raise ExtractorError('Unable to login: Incorrect password', expected=True)
            raise ExtractorError('Unable to login')

        self._AUTH_TOKEN = login.get('auth_token')
        self._IS_LOGGED_IN = True

    def _real_initialize(self):
        if not self._IS_LOGGED_IN and self._cookies_passed:
            self.report_warning(
                f'Triller does not use cookies for authentication. {self._login_hint("password")}')

    def _create_guest(self):
        guest = self._download_json(
            f'{self._API_BASE_URL}/user/create_guest',
            None, note='Creating guest session', data=b'', headers={
                'Origin': 'https://triller.co',
            }, query={
                'platform': 'Web',
                'app_version': '',
            })
        if not guest.get('auth_token'):
            raise ExtractorError('Unable to fetch required auth token for user extraction')

        self._AUTH_TOKEN = guest.get('auth_token')

    def _get_comments(self, video_id, limit=15):
        comment_info = self._download_json(
            f'{self._API_BASE_URL}/api/videos/{video_id}/comments_v2',
            video_id, fatal=False, note=False, errnote='Unable to extract comments',
            headers={
                'Origin': 'https://triller.co',
            }, query={
                'limit': limit,
            }) or {}
        comment_data = comment_info.get('comments', [])
        comments = [{
            'author': traverse_obj(comment_dict, ('author', 'username')),
            'author_id': traverse_obj(comment_dict, ('author', 'user_id')),
            'id': comment_dict.get('id'),
            'text': comment_dict.get('body'),
            'timestamp': unified_timestamp(comment_dict.get('timestamp')),
        } for comment_dict in comment_data] if comment_data else None
        return comments

    def _parse_video_info(self, video_info, user_info=None):
        video_uuid = video_info.get('video_uuid')
        video_id = video_info.get('id')
        if not user_info:
            user_info = traverse_obj(video_info, 'user', default={})

Review comment (security):
```suggestion
        self._AUTH_TOKEN = guest['auth_token']
```

Code after:
                raise ExtractorError('Unable to login: Incorrect password', expected=True)
            raise ExtractorError('Unable to login')

        self._AUTH_TOKEN = login['auth_token']

    def _get_comments(self, video_id, limit=15):
        comment_info = self._download_json(
            f'{self._API_BASE_URL}/api/videos/{video_id}/comments_v2',
            video_id, fatal=False, note='Downloading comments API JSON',
            headers={'Origin': 'https://triller.co'}, query={'limit': limit}) or {}
        if not comment_info.get('comments'):
            return
        for comment_dict in comment_info['comments']:
            yield {
                'author': traverse_obj(comment_dict, ('author', 'username')),
                'author_id': traverse_obj(comment_dict, ('author', 'user_id')),
                'id': comment_dict.get('id'),
                'text': comment_dict.get('body'),
                'timestamp': unified_timestamp(comment_dict.get('timestamp')),
            }

    def _check_user_info(self, user_info):
        if not user_info:
            self.report_warning('Unable to extract user info')
        elif user_info.get('private') and not user_info.get('followed_by_me'):
            raise ExtractorError('This video is private', expected=True)
        elif traverse_obj(user_info, 'blocked_by_user', 'blocking_user'):
            raise ExtractorError('The author of the video is blocked', expected=True)
        return user_info

    def _parse_video_info(self, video_info, username, user_info=None):
        video_uuid = video_info.get('video_uuid')
        video_id = video_info.get('id')

        formats = []
        video_url = traverse_obj(video_info, 'video_url', 'stream_url')
        if video_url:
            formats.append({
                'url': video_url,
                'ext': 'mp4',
                'vcodec': 'h264',
                'width': video_info.get('width'),
                'height': video_info.get('height'),
                'format_id': url_basename(video_url).split('.')[0],
                'filesize': video_info.get('filesize'),
            })
        video_set = video_info.get('video_set') or []
        for video in video_set:
            resolution = video.get('resolution') or ''
            formats.append({
                'url': video['url'],