storeEmptyValues writes a malformed session key where a snippet concatenates the cookie name

[justadreamer]

storeEmptyValues writes a key with JavaScript syntax in it where a snippet concatenates the cookie name. Seen on #23, at 4e99d36.

What happens

Session storage gains fod_data_51D_Bandwidth" + ". The key should be fod_data_51D_Bandwidth, the extracted name being 51D_Bandwidth. No correctly named key is written, so bandwidth never gets the empty placeholder this code exists to provide.

Since 4e99d36 moved the storeEmptyValues(body) call out of {{^_enableCookies}}, this happens in both cookie modes. Confirmed in a browser on the cookies-on GettingStarted-Web example and the cookies-off pmp-web demo.

Cause

valueSetPrefix captures the name in group 3, whose class admits quotes, whitespace and +:

([A-Za-z0-9_"\s\+]+)

That is right for the rewrite, which splices $3 back inside a string literal, so window.sessionStorage["fod_data_51D_Bandwidth" + ""] still evaluates to the correct key. It is wrong for storeEmptyValues, which uses the same capture as a literal name:

let valueName = found[3] || found[6];
window.sessionStorage[session51DataPrefix + valueName] = "";

Impact

getFodSavedValues() sweeps the _data_ prefix and buildBody() puts every result in the request body, in both modes since 4e99d36. So the server gets 51D_Bandwidth%22%20%2B%20%22= with an empty value on every request, and bandwidth still hangs where its snippet stores nothing.

Test coverage

tests/template-tests.js only ever uses "51D_name=" + value - line 366 and line 1366 - which keeps group 3 clean, so the defect cannot appear. Please cover every shape the cloud actually serves, asserting the extracted name in each case.

Must extract cleanly:

Snippet	Expected name
document.cookie = "51D_ProfileIds=" + profileIds.join("|")	51D_ProfileIds
document.cookie = "51D_ScreenPixelsHeight=" + screen.height	51D_ScreenPixelsHeight
document.cookie = "51D_ThirdPartyCookiesEnabled=" + resultValue	51D_ThirdPartyCookiesEnabled
document.cookie=`51D_GetHighEntropyValues=${btoa(JSON.stringify(t))}`	51D_GetHighEntropyValues
document.cookie="51D_IsVerifiediPhone="+"True"	51D_IsVerifiediPhone

Currently broken, and the point of the issue:

Snippet	Currently extracts	Expected
document.cookie = "51D_Bandwidth" + "=" + encodeURIComponent(value)	51D_Bandwidth" + "	51D_Bandwidth
document.cookie = "51D_Pos_" + key + "=" + pos.coords[key]	51D_Pos_" + key + "	no placeholder - the name is built at run time and cannot be known statically

Worth asserting too that every key written under the _data_ prefix matches ^[A-Za-z0-9_]+$, so any future snippet shape that breaks extraction fails loudly rather than reaching the wire.

Suggested fix

Restrict the name to [A-Za-z0-9_]+ and add an explicit alternative for the "NAME" + "=" + form, so bandwidth extracts correctly and a run-time name stops matching and gets no placeholder rather than a wrong one.

[drasmart]

Some snippets ( e.g. javascriptbandwidth, javascriptbrowseroverride ) failed not because of incorrect set replacement, but because of missing get one:

this.getCookie = function (name) {
    var value = document.cookie;
    var start = value.indexOf(" " + name + "=");
    // ...
}

or

let profileIdsCookie = document.cookie
    .split(";")
    .map(x => x.trim())
    // ...

^ valueSetPrefix was never intended to capture "read" cases, so the snippets were trying to read a different storage (cookies) from the one they were writing to (session).

---

As for 51D_Bandwidth" + " being captured, that's not an issue, as the outcome of replacement becomes

window.sessionStorage["fod_data_51D_Bandwidth" + ""]

which is completely valid, even if suboptimal.
But if a change is desired, the issue should be raised against the original snippet where this pointless addition comes from:

document.cookie = "51D_Bandwidth" + "=" + //...