Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/weverse.py (Python)

Code before:
        wmd = base64.b64encode(hmac.HMAC(
            key, f'{api_path[:255]}{wmsgpad}'.encode(), digestmod=hashlib.sha1).digest()).decode()
        headers = {'Content-Type': 'application/json'} if data else {}
        try:
            return self._download_json(
                f'https://global.apis.naver.com/weverse/wevweb{api_path}', video_id, note=note,
                data=data, headers={**self._API_HEADERS, **headers}, query={
                    'wmsgpad': wmsgpad,
                    'wmd': wmd,
                })
        except ExtractorError as e:
            if isinstance(e.cause, HTTPError) and e.cause.status == 401:
                self.raise_login_required(
                    'Session token has expired. Log in again or refresh cookies in browser')
            elif isinstance(e.cause, HTTPError) and e.cause.status == 403:
                if 'Authorization' in self._API_HEADERS:
                    raise ExtractorError('Your account does not have access to this content', expected=True)
                else:
                    self.raise_login_required()
            raise

    def _call_post_api(self, video_id):
        if 'Authorization' in self._API_HEADERS:
            return self._call_api(f'/post/v1.0/post-{video_id}?fieldSet=postV1', video_id)
        else:
            return self._call_api(f'/post/v1.0/post-{video_id}/preview?fieldSet=postV1', video_id)

    def _get_community_id(self, channel):
        return str(self._call_api(
            f'/community/v1.0/communityIdUrlPathByUrlPathArtistCode?keyword={channel}',
            channel, note='Fetching community ID')['communityId'])

    def _get_formats(self, data, video_id):
        formats = traverse_obj(data, ('videos', 'list', lambda _, v: url_or_none(v['source']), {
            'url': 'source',
            'width': ('encodingOption', 'width', {int_or_none}),
            'height': ('encodingOption', 'height', {int_or_none}),
            'vcodec': 'type',
            'vbr': ('bitrate', 'video', {int_or_none}),
            'abr': ('bitrate', 'audio', {int_or_none}),
            'filesize': ('size', {int_or_none}),
            'format_id': ('encodingOption', 'id', {str_or_none}),
        }))

        for stream in traverse_obj(data, ('streams', lambda _, v: v['type'] == 'HLS' and url_or_none(v['source']))):
            query = {}
            for param in traverse_obj(stream, ('keys', lambda _, v: v['type'] == 'param' and v['name'])):
                query[param['name']] = param.get('value', '')
            fmts = self._extract_m3u8_formats(
                stream['source'], video_id, 'mp4', m3u8_id='hls', fatal=False, query=query)
            if query:

Review comment (security):
```suggestion
        path = '' if 'Authorization' in self._API_HEADERS else '/preview'
        return self._call_api(f'/post/v1.0/post-{video_id}{path}?fieldSet=postV1', video_id)
```

Code after:
        wmd = base64.b64encode(hmac.HMAC(
            key, f'{api_path[:255]}{wmsgpad}'.encode(), digestmod=hashlib.sha1).digest()).decode()
        headers = {'Content-Type': 'application/json'} if data else {}
        try:
            return self._download_json(
                f'https://global.apis.naver.com/weverse/wevweb{api_path}', video_id, note=note,
                data=data, headers={**self._API_HEADERS, **headers}, query={
                    'wmsgpad': wmsgpad,
                    'wmd': wmd,
                })
        except ExtractorError as e:
            if isinstance(e.cause, HTTPError) and e.cause.status == 401:
                self.raise_login_required(
                    'Session token has expired. Log in again or refresh cookies in browser')
            elif isinstance(e.cause, HTTPError) and e.cause.status == 403:
                if 'Authorization' in self._API_HEADERS:
                    raise ExtractorError('Your account does not have access to this content', expected=True)
                self.raise_login_required()
            raise

    def _call_post_api(self, video_id):
        path = '' if 'Authorization' in self._API_HEADERS else '/preview'
        return self._call_api(f'/post/v1.0/post-{video_id}{path}?fieldSet=postV1', video_id)

    def _get_community_id(self, channel):
        return str(self._call_api(
            f'/community/v1.0/communityIdUrlPathByUrlPathArtistCode?keyword={channel}',
            channel, note='Fetching community ID')['communityId'])

    def _get_formats(self, data, video_id):
        formats = traverse_obj(data, ('videos', 'list', lambda _, v: url_or_none(v['source']), {
            'url': 'source',
            'width': ('encodingOption', 'width', {int_or_none}),
            'height': ('encodingOption', 'height', {int_or_none}),
            'vcodec': 'type',
            'vbr': ('bitrate', 'video', {int_or_none}),
            'abr': ('bitrate', 'audio', {int_or_none}),
            'filesize': ('size', {int_or_none}),
            'format_id': ('encodingOption', 'id', {str_or_none}),
        }))

        for stream in traverse_obj(data, ('streams', lambda _, v: v['type'] == 'HLS' and url_or_none(v['source']))):
            query = {}
            for param in traverse_obj(stream, ('keys', lambda _, v: v['type'] == 'param' and v['name'])):
                query[param['name']] = param.get('value', '')
            fmts = self._extract_m3u8_formats(
                stream['source'], video_id, 'mp4', m3u8_id='hls', fatal=False, query=query)
            if query:
                for fmt in fmts:
                    fmt['url'] = update_url_query(fmt['url'], query)
                    fmt['extra_param_to_segment_url'] = urllib.parse.urlencode(query)