Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/afreecatv.py (Python)

Code before:
            if file_element.get('file') and determine_ext(file_element.get('file')) == 'm3u8'), None)

        if needs_private_auth and m3u8_url and strm_id:
            self._request_webpage(
                _cloudfront_auth_request(m3u8_url, strm_id, video_id, url),
                video_id, note=False, fatal=False)

        error_code = traverse_obj(data, ('code', {int}))
        if error_code == -6221:
            raise ExtractorError('The VOD does not exist', expected=True)
        elif error_code == -6205:
            raise ExtractorError('This VOD is private', expected=True)

        common_info = traverse_obj(data, {
            'title': ('title', {str}),
            'uploader': ('writer_nick', {str}),
            'uploader_id': ('bj_id', {str}),
            'duration': ('total_file_duration', {int_or_none(scale=1000)}),
            'thumbnails': ('thumb', {self._fixup_thumb}),
        })

        entries = []
        for file_num, file_element in enumerate(
                traverse_obj(data, ('files', lambda _, v: url_or_none(v.get('file')))), start=1):
            file_url = file_element.get('file')
            if determine_ext(file_url) == 'm3u8':
                formats = self._extract_m3u8_formats(
                    file_url, video_id, 'mp4', m3u8_id='hls',
                    note=f'Downloading part {file_num} m3u8 information')
            else:
                formats = [{
                    'url': file_url,
                    'format_id': 'http',
                }]

            entry = {
                **common_info,
                'id': file_element.get('file_info_key') or f'{video_id}_{file_num}',
                'title': f'{common_info.get("title") or "Untitled"} (part {file_num})',
                'formats': formats,
                **traverse_obj(file_element, {
                    'duration': ('duration', {int_or_none(scale=1000)}),
                    'timestamp': ('file_start', {parse_iso8601(delimiter=' ', timezone=dt.timedelta(hours=9))}),
                }),
            }

            if needs_private_auth and m3u8_url and strm_id and determine_ext(file_url) == 'm3u8':
                for fmt in formats:
                    fmt['protocol'] = 'afreecatv'
                entry['_cookie_refresh_params'] = {
                    'm3u8_url': file_url,

Review comment (security):
This is where the rest of the logic from above and below could go

Could add a `referer_url` here too if you want
```py
                formats = self._extract_m3u8_formats(
                    file_url, video_id, 'mp4', m3u8_id='hls',
                    note=f'Downloading part {file_num} m3u8 information')

                if needs_private_auth:
                    for fmt in formats:
                        fmt['protocol'] = 'soopvod'
                        fmt['_cookie_refresh_params'] = {
                            'm3u8_url': file_url,
                            'strm_id': strm_id,
                            'video_id': video_id,
                            'referer_url': url,
                            '_last_refresh': last_refresh_time,
                        }
```

Code after:
        error_code = traverse_obj(data, ('code', {int}))
        if error_code == -6221:
            raise ExtractorError('The VOD does not exist', expected=True)
        elif error_code == -6205:
            raise ExtractorError('This VOD is private', expected=True)

        common_info = traverse_obj(data, {
            'title': ('title', {str}),
            'uploader': ('writer_nick', {str}),
            'uploader_id': ('bj_id', {str}),
            'duration': ('total_file_duration', {int_or_none(scale=1000)}),
            'thumbnails': ('thumb', {self._fixup_thumb}),
        })

        entries = []
        for file_num, file_element in enumerate(
                traverse_obj(data, ('files', lambda _, v: url_or_none(v['file']))), start=1):
            file_url = file_element['file']
            if determine_ext(file_url) == 'm3u8':
                if needs_private_auth:
                    self._request_webpage(
                        _cloudfront_auth_request(file_url, strm_id, video_id, url),
                        video_id, 'Requesting CloudFront cookies', 'Failed to get CloudFront cookies')
                    initial_refresh_time = time.time()
                formats = self._extract_m3u8_formats(
                    file_url, video_id, 'mp4', m3u8_id='hls',
                    note=f'Downloading part {file_num} m3u8 information')
                if needs_private_auth:
                    for fmt in formats:
                        fmt['protocol'] = 'soopvod'
                        fmt['_cookie_refresh_params'] = {
                            'm3u8_url': file_url,
                            'strm_id': strm_id,
                            'video_id': video_id,
                            '_last_refresh': initial_refresh_time,
                        }
            else:
                formats = [{
                    'url': file_url,
                    'format_id': 'http',
                }]

            entries.append({
                **common_info,
                'id': file_element.get('file_info_key') or f'{video_id}_{file_num}',
                'title': f'{common_info.get("title") or "Untitled"} (part {file_num})',
                'formats': formats,
                **traverse_obj(file_element, {
                    'duration': ('duration', {int_or_none(scale=1000)}),
                    'timestamp': ('file_start', {parse_iso8601(delimiter=' ', timezone=dt.timedelta(hours=9))}),
                }),