arduino_secrets.h removal system corrupts sketch code if #include directive is commented

[per1234]

Describe the problem

Arduino Web Editor has a "Secret tab" feature that makes it easy to share sketches without accidentally exposing sensitive data (e.g., passwords or tokens).

The values of these secrets can be defined on Arduino Cloud via a form in the "Secret" tab in Arduino Web Editor.

On Arduino Cloud, secrets are stored in a secure database and the secret macro values populated from there.

The secrets database capability is not available when using the Arduino IDE, so a more conventional approach is taken by defining the secrets macros in a header file named arduino_secrets.h, then adding an #include directive for the file to sketch files that reference the macros. When a Cloud sketch is pushed to the Arduino Cloud server, these #include directives are removed from the sketch cod.

🐛 If the #include directive is commented out, the removal code leaves the comment in place and moves the next line of code up, resulting in that code being incorrectly commented out. Depending on what that line is, this could completely break the sketch program.

To reproduce

1. Start Arduino IDE.
2. Select File > New Cloud Sketch from the Arduino IDE menus.
   A new sketch will open in an Arduino IDE window.
3. Change the sketch code to the following:

   //#include "arduino_secrets.h"
   void setup() {}
   void loop() {}

4. Push the sketch to Arduino Cloud.
5. Open the sketch in Arduino Cloud Editor.

🐛 The sketch code has been corrupted:

//void setup() {}
void loop() {}

Expected behavior

Only real #include directives for arduino_secrets.h are removed. If the string happens to be present in a comment, Arduino IDE should just leave it alone.

Removal of #include "arduino_secrets.h" never harms the other code in the sketch.

Arduino IDE version

aa9b10d

Operating system

• Windows

Operating system version

• Windows 11

Additional context

Originally reported at https://forum.arduino.cc/t/web-editor-deletes-include-from-pushed-code/1289947

Related

• Improve detection of #include directives for arduino_secrets.h #447

Issue checklist

• I searched for previous reports in the issue tracker
• I verified the problem still occurs when using the latest nightly build
• My report contains all necessary details