html/template: escaping of script tokens from json.Marshal errors is not case insensitive

[rolandshoemaker]

The fix for #65697 does not take case into account, only escaping the lower case </script.

This is a PUBLIC track security issue.

Thanks to Juho Forsén of Mattermost for reporting this issue.

[gopherbot]

Change https://go.dev/cl/634696 mentions this issue: html/template: escape script tags in JS errors case insensitively

[gabyhelp]

Related Code Changes

• html/template: escape script tags in JS errors case insensitively

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}