Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/playsuisse.py (Python)

Code before:
            thumbnail2x3WithTitle {
                ...ImageDetails
            }
        }
        fragment ImageDetails on AssetImage {
            id
            url
        }'''
    _ID_TOKEN = None

    def _perform_login(self, username, password):
        login_page = self._download_webpage(
            'https://www.playsuisse.ch/api/sso/login', None, note='Downloading login page',
            query={'x': 'x', 'locale': 'de', 'redirectUrl': 'https://www.playsuisse.ch/'})
        settings = self._search_json(r'var\s+SETTINGS\s*=', login_page, 'settings', None)

        webpage, urlh = self._download_webpage_handle(
            'https://login.srgssr.ch/srgssrlogin.onmicrosoft.com/B2C_1A__SignInV2/SelfAsserted',
            None, note='Logging in', headers={'X-CSRF-TOKEN': settings['csrf']},
            data=urlencode_postdata({'request_type': 'RESPONSE', 'signInName': username, 'password': password}),
            query={'tx': settings['transId'], 'p': 'B2C_1A__SignInV2'})

        webpage, urlh = self._download_webpage_handle(
            'https://login.srgssr.ch/srgssrlogin.onmicrosoft.com/B2C_1A__SignInV2/api/CombinedSigninAndSignup/confirmed',
            None, note='Downloading ID token',
            query={'rememberMe': 'false', 'csrf_token': settings['csrf'], 'tx': settings['transId'], 'p': 'B2C_1A__SignInV2', 'diags': ''})

        query = parse_qs(urlh.url)
        if 'id_token' not in query:
            raise ExtractorError("Login failed")
        self._ID_TOKEN = query['id_token'][0]

    def _get_media_data(self, media_id):
        # NOTE In the web app, the "locale" header is used to switch between languages,
        # However this doesn't seem to take effect when passing the header here.
        response = self._download_json(
            'https://www.playsuisse.ch/api/graphql',
            media_id, data=json.dumps({
                'operationName': 'AssetWatch',
                'query': self._GRAPHQL_QUERY,
                'variables': {'assetId': media_id}
            }).encode('utf-8'),
            headers={'Content-Type': 'application/json', 'locale': 'de'})

        return response['data']['assetV2']

    def _real_extract(self, url):
        if not self._ID_TOKEN:
            self.raise_login_required()

        media_id = self._match_id(url)

Review comment (security):
we're not using `webpage` for anything, so `_request_webpage()` will suffice
```suggestion
        urlh = self._request_webpage(
            f'{self._LOGIN_BASE_URL}/{self._LOGIN_PATH}/api/CombinedSigninAndSignup/confirmed',
            None, 'Downloading ID token', query={
                'rememberMe': 'false',
                'csrf_token': csrf_token,
                **query,
                'diags': '',
            })
```

Code after:
            }
            thumbnail2x3 {
                ...ImageDetails
            }
            thumbnail16x9WithTitle {
                ...ImageDetails
            }
            thumbnail2x3WithTitle {
                ...ImageDetails
            }
        }
        fragment ImageDetails on AssetImage {
            id
            url
        }'''
    _LOGIN_BASE_URL = 'https://login.srgssr.ch/srgssrlogin.onmicrosoft.com'
    _LOGIN_PATH = 'B2C_1A__SignInV2'
    _ID_TOKEN = None

    def _perform_login(self, username, password):
        login_page = self._download_webpage(
            'https://www.playsuisse.ch/api/sso/login', None, note='Downloading login page',
            query={'x': 'x', 'locale': 'de', 'redirectUrl': 'https://www.playsuisse.ch/'})
        settings = self._search_json(r'var\s+SETTINGS\s*=', login_page, 'settings', None)

        csrf_token = settings['csrf']
        query = {'tx': settings['transId'], 'p': self._LOGIN_PATH}

        status = traverse_obj(self._download_json(
            f'{self._LOGIN_BASE_URL}/{self._LOGIN_PATH}/SelfAsserted', None, 'Logging in',
            query=query, headers={'X-CSRF-TOKEN': csrf_token}, data=urlencode_postdata({
                'request_type': 'RESPONSE',
                'signInName': username,
                'password': password
            }), expected_status=400), ('status', {int_or_none}))
        if status == 400:
            raise ExtractorError('Invalid username or password', expected=True)

        urlh = self._request_webpage(
            f'{self._LOGIN_BASE_URL}/{self._LOGIN_PATH}/api/CombinedSigninAndSignup/confirmed',
            None, 'Downloading ID token', query={
                'rememberMe': 'false',
                'csrf_token': csrf_token,
                **query,
                'diags': '',
            })

        self._ID_TOKEN = traverse_obj(parse_qs(urlh.url), ('id_token', 0))
        if not self._ID_TOKEN:
            raise ExtractorError('Login failed')