Repository: conda/conda-build

Issue:
about.json leaks credentials
### Actual Behavior

When building a package, `about.json` contains a copy of all Conda channels specified in .condarc - ***including login credentials***.

```json
{
  "channels": [
    "https://USER:XXXXXXXX@example.com/conda",
    "conda-forge",
    "defaults"
  ],
```

### Expected Behavior

Credential data should be either stripped off or masked.

### Steps to Reproduce

1. add a Conda channel with inline credential information to .condarc
2. build any package
3. unpack the resulting .tar.bz2 and look at info/about.json


##### `Output of conda info`

```
     active environment : base
    active env location : C:\Users\user\Miniconda3
            shell level : 1
       user config file : C:\Users\user\.condarc
 populated config files : C:\Users\user\Miniconda3\.condarc
          conda version : 4.8.3
    conda-build version : 3.19.2
         python version : 3.7.6.final.0
       virtual packages :
       base environment : C:\Users\user\Miniconda3  (writable)
           channel URLs : https://USER:XXXXXXXX@example.com/conda/win64
                          https://USER:XXXXXXXX@example.com/conda/noarch
                          https://conda.anaconda.org/conda-forge/win-63
                          https://conda.anaconda.org/conda-forge/noarch
                          https://repo.anaconda.com/pkgs/main/win-64
                          https://repo.anaconda.com/pkgs/main/noarch
                          https://repo.anaconda.com/pkgs/r/win-64
                          https://repo.anaconda.com/pkgs/r/noarch
                          https://repo.anaconda.com/pkgs/msys2/win-64
                          https://repo.anaconda.com/pkgs/msys2/noarch
          package cache : C:\Users\user\Miniconda3\pkgs
                          C:\Users\user\.conda\pkgs
                          C:\Users\user\AppData\Local\conda\conda\pkgs
       envs directories : C:\Users\user\Miniconda3\envs
                          C:\Users\user\.conda\envs
                          C:\Users\user\AppData\Local\conda\conda\envs
               platform : win-64
             user-agent : conda/4.8.3 requests/2.23.0 CPython/3.7.6 Windows/10 Windows/10.0.18362
          administrator : False
             netrc file : C:\Users\user/.netrc
           offline mode : False
```



Discussion:
Apparently this was introduced in #1407, which does include a `sanitize_channel()` function, but that only removes a token, not the login credentials.
The `url()` method of the `Channel` class of conda has a `with_credentials` parameter (defaults to False), which seems to strip both the token and the auth values: https://github.com/conda/conda/blob/e5a596438122ae15347aec16a2370423d7917b46/conda/models/channel.py#L206

It seems that this function should be used instead of the `sanitize_channel()` function in conda-build: https://github.com/conda/conda-build/blob/1ae7f9508f6fc465086d4faf0ab1f63610745202/conda_build/build.py#L1079


Resolving patch:
diff --git a/conda_build/build.py b/conda_build/build.py
--- a/conda_build/build.py
+++ b/conda_build/build.py
@@ -52,6 +52,7 @@
 from .conda_interface import NoPackagesFoundError
 from .conda_interface import CondaError
 from .conda_interface import pkgs_dirs
+from .conda_interface import get_conda_channel
 from .utils import (CONDA_PACKAGE_EXTENSION_V1, CONDA_PACKAGE_EXTENSION_V2,
                     CONDA_PACKAGE_EXTENSIONS, env_var, glob,
                     shutil_move_more_retrying, tmp_chdir)
@@ -1077,7 +1078,7 @@ def record_prefix_files(m, files_with_prefix):
 
 
 def sanitize_channel(channel):
-    return re.sub(r'\/t\/[a-zA-Z0-9\-]*\/', '/t/<TOKEN>/', channel)
+    return get_conda_channel(channel).urls(with_credentials=False, subdirs=[''])[0]
 
 
 def write_info_files_file(m, files):


Test patch:
diff --git a/tests/test_build.py b/tests/test_build.py
--- a/tests/test_build.py
+++ b/tests/test_build.py
@@ -50,7 +50,9 @@ def test_build_preserves_PATH(testing_workdir, testing_config):
 
 def test_sanitize_channel():
     test_url = 'https://conda.anaconda.org/t/ms-534991f2-4123-473a-b512-42025291b927/somechannel'
-    assert build.sanitize_channel(test_url) == 'https://conda.anaconda.org/t/<TOKEN>/somechannel'
+    assert build.sanitize_channel(test_url) == 'https://conda.anaconda.org/somechannel'
+    test_url_auth = 'https://myuser:mypass@conda.anaconda.org/somechannel'
+    assert build.sanitize_channel(test_url_auth) == 'https://conda.anaconda.org/somechannel'
 
 
 def test_get_short_path(testing_metadata):