Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/mlb.py (Python)

Code before:
class MLBTVIE(InfoExtractor):
    _VALID_URL = r'https?://(?:www\.)?mlb\.com/tv/g(?P<id>\d{6})'
    _NETRC_MACHINE = 'mlb'

    _TESTS = [{
        'url': 'https://www.mlb.com/tv/g661581/vee2eff5f-a7df-4c20-bdb4-7b926fa12638',
        'info_dict': {
            'id': '661581',
            'ext': 'mp4',
            'title': '2022-07-02 - St. Louis Cardinals @ Philadelphia Phillies',
        },
        'params': {
            'skip_download': True,
        },
    }]

    def _perform_login(self, username, password):

        access_token = self._download_json(
            'https://ids.mlb.com/oauth2/aus1m088yK07noBfh356/v1/token', None,
            headers={
                'User-Agent': 'okhttp/3.12.1',
                'Content-Type': 'application/x-www-form-urlencoded'},
            data=(('grant_type=password&username=%s&password=%s&scope=openid offline_access'
                  '&client_id=0oa3e1nutA1HLzAKG356') % (urllib.parse.quote(username), urllib.parse.quote(password))).encode()
        )['access_token']

        entitlement = self._download_webpage(
            f'https://media-entitlement.mlb.com/api/v3/jwt?os=Android&appname=AtBat&did={str(uuid.uuid4())}', None,
            headers={
                'User-Agent': 'okhttp/3.12.1',
                'Authorization': f'Bearer {access_token}'
            })

        access_token = self._download_json(
            'https://us.edge.bamgrid.com/token', None,
            headers={
                'Accept': 'application/json',
                'Authorization': 'Bearer bWxidHYmYW5kcm9pZCYxLjAuMA.6LZMbH2r--rbXcgEabaDdIslpo4RyZrlVfWZhsAgXIk',
                'Content-Type': 'application/x-www-form-urlencoded'
            },
            data=(
                 ('grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=%s'
                  '&subject_token_type=urn:ietf:params:oauth:token-type:jwt&platform=android-tv') % entitlement).encode()
        )['access_token']

        self._access_token = access_token

    def _real_extract(self, url):
        video_id = self._match_id(url)
        formats, subtitles = [], {}

Review comment (security):
```suggestion
        data = f'grant_type=password&username={urllib.parse.quote(username)}&password={urllib.parse.quote(password)}&scope=openid offline_access&client_id=0oa3e1nutA1HLzAKG356'
        access_token = self._download_json(
            'https://ids.mlb.com/oauth2/aus1m088yK07noBfh356/v1/token', None,
            headers={
                'User-Agent': 'okhttp/3.12.1',
                'Content-Type': 'application/x-www-form-urlencoded'
            }, data=data.encode())['access_token']
```

Code after:

class MLBTVIE(InfoExtractor):
    _VALID_URL = r'https?://(?:www\.)?mlb\.com/tv/g(?P<id>\d{6})'
    _NETRC_MACHINE = 'mlb'

    _TESTS = [{
        'url': 'https://www.mlb.com/tv/g661581/vee2eff5f-a7df-4c20-bdb4-7b926fa12638',
        'info_dict': {
            'id': '661581',
            'ext': 'mp4',
            'title': '2022-07-02 - St. Louis Cardinals @ Philadelphia Phillies',
        },
        'params': {
            'skip_download': True,
        },
    }]
    _access_token = None

    def _real_initialize(self):
        if not self._access_token:
            self.raise_login_required(
                'All videos are only available to registered users', method='password')

    def _perform_login(self, username, password):
        data = f'grant_type=password&username={urllib.parse.quote(username)}&password={urllib.parse.quote(password)}&scope=openid offline_access&client_id=0oa3e1nutA1HLzAKG356'
        access_token = self._download_json(
            'https://ids.mlb.com/oauth2/aus1m088yK07noBfh356/v1/token', None,
            headers={
                'User-Agent': 'okhttp/3.12.1',
                'Content-Type': 'application/x-www-form-urlencoded'
            }, data=data.encode())['access_token']

        entitlement = self._download_webpage(
            f'https://media-entitlement.mlb.com/api/v3/jwt?os=Android&appname=AtBat&did={str(uuid.uuid4())}', None,
            headers={
                'User-Agent': 'okhttp/3.12.1',
                'Authorization': f'Bearer {access_token}'
            })

        data = f'grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token={entitlement}&subject_token_type=urn:ietf:params:oauth:token-type:jwt&platform=android-tv'
        self._access_token = self._download_json(
            'https://us.edge.bamgrid.com/token', None,
            headers={
                'Accept': 'application/json',
                'Authorization': 'Bearer bWxidHYmYW5kcm9pZCYxLjAuMA.6LZMbH2r--rbXcgEabaDdIslpo4RyZrlVfWZhsAgXIk',
                'Content-Type': 'application/x-www-form-urlencoded'
            }, data=data.encode())['access_token']

    def _real_extract(self, url):
        video_id = self._match_id(url)
        airings = self._download_json(