Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/mlb.py (Python)

Code before:
            })

        data = f'grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token={entitlement}&subject_token_type=urn:ietf:params:oauth:token-type:jwt&platform=android-tv'
        self._access_token = self._download_json(
            'https://us.edge.bamgrid.com/token', None,
            headers={
                'Accept': 'application/json',
                'Authorization': 'Bearer bWxidHYmYW5kcm9pZCYxLjAuMA.6LZMbH2r--rbXcgEabaDdIslpo4RyZrlVfWZhsAgXIk',
                'Content-Type': 'application/x-www-form-urlencoded'
            }, data=data.encode())['access_token']

    def _real_extract(self, url):
        video_id = self._match_id(url)
        formats, subtitles = [], {}
        airings = self._download_json(
            f'https://search-api-mlbtv.mlb.com/svc/search/v2/graphql/persisted/query/core/Airings?variables=%7B%22partnerProgramIds%22%3A%5B%22{video_id}%22%5D%2C%22applyEsniMediaRightsLabels%22%3Atrue%7D',
            video_id)['data']['Airings']
        for airing in airings:
            playback = self._download_json(
                airing['playbackUrls'][0]['href'].format(scenario='browser~csai'), video_id,
                headers={
                    'Authorization': self._access_token,
                    'Accept': 'application/vnd.media-service+json; version=2'
                })
            m3u8_url = playback['stream']['complete']
            f, s = self._extract_m3u8_formats_and_subtitles(
                m3u8_url, video_id, 'mp4', m3u8_id=join_nonempty(airing.get('feedType'), airing.get('feedLanguage')))
            formats.extend(f)
            self._merge_subtitles(s, subtitles)

        self._sort_formats(formats)
        return {
            'title': traverse_obj(airings, (..., 'titles', 0, 'episodeName'), get_all=False),
            'formats': formats,
            'subtitles': subtitles,
            'http_headers': {'Authorization': f'Bearer {self._access_token}'},
            'id': video_id
        }


Review comment (security):
```suggestion
            m3u8_url = self._download_json(
                airing['playbackUrls'][0]['href'].format(scenario='browser~csai'), video_id,
                headers={
                    'Authorization': self._access_token,
                    'Accept': 'application/vnd.media-service+json; version=2'
                })['stream']['complete']
            f, s = self._extract_m3u8_formats_and_subtitles(
```

Code after:
            })

        data = f'grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token={entitlement}&subject_token_type=urn:ietf:params:oauth:token-type:jwt&platform=android-tv'
        self._access_token = self._download_json(
            'https://us.edge.bamgrid.com/token', None,
            headers={
                'Accept': 'application/json',
                'Authorization': 'Bearer bWxidHYmYW5kcm9pZCYxLjAuMA.6LZMbH2r--rbXcgEabaDdIslpo4RyZrlVfWZhsAgXIk',
                'Content-Type': 'application/x-www-form-urlencoded'
            }, data=data.encode())['access_token']

    def _real_extract(self, url):
        video_id = self._match_id(url)
        airings = self._download_json(
            f'https://search-api-mlbtv.mlb.com/svc/search/v2/graphql/persisted/query/core/Airings?variables=%7B%22partnerProgramIds%22%3A%5B%22{video_id}%22%5D%2C%22applyEsniMediaRightsLabels%22%3Atrue%7D',
            video_id)['data']['Airings']
    
        formats, subtitles = [], {}
        for airing in airings:
            m3u8_url = self._download_json(
                airing['playbackUrls'][0]['href'].format(scenario='browser~csai'), video_id,
                headers={
                    'Authorization': self._access_token,
                    'Accept': 'application/vnd.media-service+json; version=2'
                })['stream']['complete']
            f, s = self._extract_m3u8_formats_and_subtitles(
                m3u8_url, video_id, 'mp4', m3u8_id=join_nonempty(airing.get('feedType'), airing.get('feedLanguage')))
            formats.extend(f)
            self._merge_subtitles(s, target=subtitles)

        self._sort_formats(formats)
        return {
            'id': video_id,
            'title': traverse_obj(airings, (..., 'titles', 0, 'episodeName'), get_all=False),
            'formats': formats,
            'subtitles': subtitles,
            'http_headers': {'Authorization': f'Bearer {self._access_token}'},
        }