It was identified that...

In T396359#11045569, @dr0ptp4kt wrote:

...
It seems that experiments.js's getXExperimentEnrollments method may have a logic issue that, while guarding against bad headers, may not have the exact behavior that was intended.

If the X-Experiment-Enrollments header bears the value which doesn't match the regex (e.g., X-Experiment-Enrollments: boo), the regex may have no matches, and I believe thus experiments.js's getEnrolledExperiment may return an empty value, and then a HoistingError will be thrown instead of a MalformedHeaderError.
....

The expected behavior if encountering zero matches in the regex when the X-Experiment-Enrollments header is present shouldn't be to result in a HoistingError error, bur rather to throw a MalformedHeaderError error.

There may be other considerations, and I'll share them here, but I think we should opt for a simple approach here and just throw a MalformedHeaderError for this case and not overthink it. But, in the interest of other considerations for maintainability and defensive coding / smart graceful failures: this could require a little extra thought. On the one hand, we may want to allow through non-A/B test events if they're otherwise well-formed, because that would likely be a case of some misconfiguration independent of anything to do with the event (and that misconfiguration may really not be problematic). On the other hand, if the type of event is an A/B test event, then a malformed header is an error case that is "more" specious. On the other other hand we really don't want to be seeing this header badly behaved under any circumstance (other than us ourselves intentionally inducing it, the purpose of which is to make sure our handling is correct for this very special circumstance).