static bool StartsClosingScriptTagAt(const String& string, size_t start) {
  if (start + 7 >= string.length())
    return false;
  StringView script("</script");
  return EqualIgnoringASCIICase(StringView(string, start, script.length()),
                                script);
}

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.