Fixed #21731 -- Made javascript_quote escapes '</'.

2 files changed, 12 insertions, 0 deletions

diff --git a/django/utils/text.py b/django/utils/text.py
index f52050cccc..c2da31a554 100644
--- a/django/utils/text.py
+++ b/django/utils/text.py
@@ -327,6 +327,7 @@ def javascript_quote(s, quote_double_quotes=False):
     s = s.replace('\n', '\\n')
     s = s.replace('\t', '\\t')
     s = s.replace("'", "\\'")
+    s = s.replace('</', '<\\/')
     if quote_double_quotes:
         s = s.replace('"', '&quot;')
     return str(ustring_re.sub(fix, s))
diff --git a/tests/utils_tests/test_text.py b/tests/utils_tests/test_text.py
index 86fe8c38ad..bf547b62d2 100644
--- a/tests/utils_tests/test_text.py
+++ b/tests/utils_tests/test_text.py
@@ -144,3 +144,14 @@ class TestUtilsText(SimpleTestCase):
     def test_get_valid_filename(self):
         filename = "^&'@{}[],$=!-#()%+~_123.txt"
         self.assertEqual(text.get_valid_filename(filename), "-_123.txt")
+
+    def test_javascript_quote(self):
+        input = "<script>alert('Hello \\xff.\n Welcome\there\r');</script>"
+        output = r"<script>alert(\'Hello \\xff.\n Welcome\there\r\');<\/script>"
+        self.assertEqual(text.javascript_quote(input), output)
+
+        # Exercising quote_double_quotes keyword argument
+        input = '"Text"'
+        self.assertEqual(text.javascript_quote(input), '"Text"')
+        self.assertEqual(text.javascript_quote(input, quote_double_quotes=True),
+                         '&quot;Text&quot;')