diff --git a/src/html/template/js.go b/src/html/template/js.go
index d1463dee14..b3bf94801b 100644
--- a/src/html/template/js.go
+++ b/src/html/template/js.go
@@ -9,6 +9,7 @@ import (
"encoding/json"
"fmt"
"reflect"
+ "regexp"
"strings"
"unicode/utf8"
)
@@ -144,6 +145,8 @@ func indirectToJSONMarshaler(a any) any {
return v.Interface()
}
+var scriptTagRe = regexp.MustCompile("(?i)<(/?)script")
+
// jsValEscaper escapes its inputs to a JS Expression (section 11.14) that has
// neither side-effects nor free variables outside (NaN, Infinity).
func jsValEscaper(args ...any) string {
@@ -181,9 +184,9 @@ func jsValEscaper(args ...any) string {
// In particular we:
// * replace "*/" comment end tokens with "* /", which does not
// terminate the comment
- // * replace "