Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/instagram.py (Python)

Code before:
        return num

    def _real_extract(self, url):
        video_id, url = self._match_valid_url(url).group('id', 'url')
        webpageh = self._download_webpage_handle(url, video_id, fatal=False)
        if not webpageh:
            self.raise_no_formats('Requested content was not found')
        else:
            webpage, urlh = webpageh
        media_id = self._get_pk(video_id)
        info = self._download_json(
            f'https://i.instagram.com/api/v1/media/{media_id}/info/',
            video_id,
            headers={
                'accept': ('text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,'
                           'image/avif,image/webp,image/apng,*/*;q=0.8,'
                           'application/signed-exchange;v=b3;q=0.9'),
                'authority': 'www.instagram.com',
                'referer': 'https://www.instagram.com',
                'user-agent': ('Mozilla/5.0 (X11; Linux x86_64) '
                               'AppleWebKit/537.36 (KHTML, like Gecko) '
                               'Chrome/103.0.0.0 Safari/537.36'),
                'x-ig-app-id': '936619743392459',
            },
            fatal=False
        )
        if not info:
            if 'www.instagram.com/accounts/login' in urlh.geturl():
                self.report_warning(
                    'Main webpage is locked behind the login page. '
                    'Retrying with embed webpage (Note that some metadata might '
                    'be missing)')
                webpage = self._download_webpage(
                    f'https://www.instagram.com/p/{video_id}/embed/',
                    video_id, note='Downloading embed webpage', fatal=False)
                if not webpage:
                    self.raise_login_required('Requested content was not found, the content might be private')

            shared_data = self._parse_json(
                self._search_regex(
                    r'window\._sharedData\s*=\s*({.+?});',
                    webpage, 'shared data', default='{}'),
                video_id, fatal=False)
            media = traverse_obj(
                shared_data,
                ('entry_data', 'PostPage', 0, 'graphql', 'shortcode_media'),
                ('entry_data', 'PostPage', 0, 'media'),
                expected_type=dict)

            if not media:
                additional_data = self._parse_json(

Review comment (security):
```suggestion
        info = self._download_json(
            f'https://i.instagram.com/api/v1/media/{media_id}/info/', video_id, fatal=False,
            errnote='The webpage is locked behind login. Trying with embed webpage - some metadata might be missing',
            headers={
                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
                'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36',
                'Authority': 'www.instagram.com',
                'Referer': 'https://www.instagram.com',
                'x-ig-app-id': '936619743392459',
            })
```

Code after:
            '"parent_comment_count":10,"has_threaded_comments":true}', video_id, fatal=False, errnote=False,
            headers={
                'Accept': '*',
                'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36',
                'Authority': 'www.instagram.com',
                'Referer': 'https://www.instagram.com',
                'x-ig-app-id': '936619743392459',
            })
        media = traverse_obj(general_info, ('data', 'shortcode_media')) or {}
        if not media:
            self.report_warning('General metadata extraction failed', video_id)

        info = self._download_json(
            f'https://i.instagram.com/api/v1/media/{_id_to_pk(video_id)}/info/', video_id,
            fatal=False, note='Downloading video info', errnote=False, headers={
                'Accept': '*',
                'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36',
                'Authority': 'www.instagram.com',
                'Referer': 'https://www.instagram.com',
                'x-ig-app-id': '936619743392459',
            })
        if info:
            media.update(info['items'][0])
            return self._extract_product(media)

        webpage = self._download_webpage(
            f'https://www.instagram.com/p/{video_id}/embed/', video_id,
            note='Downloading embed webpage', fatal=False)
        if not webpage:
            self.raise_login_required('Requested content was not found, the content might be private')

        additional_data = self._search_json(
            r'window\.__additionalDataLoaded\s*\(\s*[^,]+,\s*', webpage, 'additional data', video_id, fatal=False)
        product_item = traverse_obj(additional_data, ('items', 0), expected_type=dict)
        if product_item:
            media.update(product_item)
            return self._extract_product(media)

        media.update(traverse_obj(
            additional_data, ('graphql', 'shortcode_media'), 'shortcode_media', expected_type=dict) or {})

        username = traverse_obj(media, ('owner', 'username')) or self._search_regex(
            r'"owner"\s*:\s*{\s*"username"\s*:\s*"(.+?)"', webpage, 'username', fatal=False)

        description = (
            traverse_obj(media, ('edge_media_to_caption', 'edges', 0, 'node', 'text'), expected_type=str)
            or media.get('caption'))
        if not description:
            description = self._search_regex(
                r'"caption"\s*:\s*"(.+?)"', webpage, 'description', default=None)
            if description is not None: