Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/youtube.py (Python)

Code before:
        if cookies.get('__Secure-3PSID'):
            return
        socs = cookies.get('SOCS')
        if socs and not socs.value.startswith('CAA'):  # not consented
            return
        self._set_cookie('.youtube.com', 'SOCS', 'CAI', secure=True)  # accept all (required for mixes)

    def _initialize_pref(self):
        cookies = self._get_cookies('https://www.youtube.com/')
        pref_cookie = cookies.get('PREF')
        pref = {}
        if pref_cookie:
            try:
                pref = dict(urllib.parse.parse_qsl(pref_cookie.value))
            except ValueError:
                self.report_warning('Failed to parse user PREF cookie' + bug_reports_message())
        pref.update({'hl': self._preferred_lang or 'en', 'tz': 'UTC'})
        self._set_cookie('.youtube.com', name='PREF', value=urllib.parse.urlencode(pref))

    def _real_initialize(self):
        self._initialize_pref()
        self._initialize_consent()
        self._check_login_required()

    def _perform_login(self, username, password):
        auth_type, sep, user = (username or '').partition('+')

        if auth_type != 'oauth':
            raise ExtractorError(
                'Login using username and password is not supported. '
                'Use  --username=oauth[+PROFILE] --password=""  to log in using oauth, '
                f'or else {self._login_hint(method="cookies")}', expected=True)

        self._initialize_oauth(user, password)

    # OAuth 2.0 Device Authorization Grant flow, used by the YouTube TV client (youtube.com/tv).
    #
    # For more information regarding OAuth 2.0 and the Device Authorization Grant flow in general, see:
    # - https://developers.google.com/identity/protocols/oauth2/limited-input-device
    # - https://accounts.google.com/.well-known/openid-configuration
    # - https://www.rfc-editor.org/rfc/rfc8628
    # - https://www.rfc-editor.org/rfc/rfc6749
    #
    # Note: The official client appears to use a proxied version of the oauth2 endpoints on youtube.com/o/oauth2,
    # which applies some modifications to the response (such as returning errors as 200 OK).
    # Since the client works with the standard API, we will use that as it is well-documented.

    _OAUTH_PROFILE = None
    _OAUTH_ACCESS_TOKEN_CACHE = {}
    _OAUTH_DISPLAY_ID = 'oauth'


Review comment (security):
```suggestion
        auth_type, _, user = (username or '').partition('+')
```

Code after:
        if cookies.get('__Secure-3PSID'):
            return
        socs = cookies.get('SOCS')
        if socs and not socs.value.startswith('CAA'):  # not consented
            return
        self._set_cookie('.youtube.com', 'SOCS', 'CAI', secure=True)  # accept all (required for mixes)

    def _initialize_pref(self):
        cookies = self._get_cookies('https://www.youtube.com/')
        pref_cookie = cookies.get('PREF')
        pref = {}
        if pref_cookie:
            try:
                pref = dict(urllib.parse.parse_qsl(pref_cookie.value))
            except ValueError:
                self.report_warning('Failed to parse user PREF cookie' + bug_reports_message())
        pref.update({'hl': self._preferred_lang or 'en', 'tz': 'UTC'})
        self._set_cookie('.youtube.com', name='PREF', value=urllib.parse.urlencode(pref))

    def _real_initialize(self):
        self._initialize_pref()
        self._initialize_consent()
        self._check_login_required()

    def _perform_login(self, username, password):
        auth_type, _, user = (username or '').partition('+')

        if auth_type != 'oauth':
            raise ExtractorError(self._youtube_login_hint, expected=True)

        self._initialize_oauth(user, password)

    '''
    OAuth 2.0 Device Authorization Grant flow, used by the YouTube TV client (youtube.com/tv).

    For more information regarding OAuth 2.0 and the Device Authorization Grant flow in general, see:
    - https://developers.google.com/identity/protocols/oauth2/limited-input-device
    - https://accounts.google.com/.well-known/openid-configuration
    - https://www.rfc-editor.org/rfc/rfc8628
    - https://www.rfc-editor.org/rfc/rfc6749

    Note: The official client appears to use a proxied version of the oauth2 endpoints on youtube.com/o/oauth2,
    which applies some modifications to the response (such as returning errors as 200 OK).
    Since the client works with the standard API, we will use that as it is well-documented.
    '''

    _OAUTH_PROFILE = None
    _OAUTH_ACCESS_TOKEN_CACHE = {}
    _OAUTH_DISPLAY_ID = 'oauth'

    # YouTube TV (TVHTML5) client. You can find these at youtube.com/tv