const regex = /(<script)((?:(?!src=).)*?>)/g;
// Alternative syntax using RegExp constructor
// const regex = new RegExp('(<script)((?:(?!src=).)*?>)', 'g')
const str = `<script>console.log("Jareté!");</script>
<script type="text/javascript">console.log('Hola!');</script>
<script type="text/javascript">console.log("Jaguereté!");</script>
<script type="text/javascript" src="whatever.js">console.log("Jaguereté!");</script>
<script type="text/javascript" src="whatever.js">console.log("Jaguereté!");</script> `;
const subst = `$1 nonce="$cspNonce"$2`;
// The substituted value will be contained in the result variable
const result = str.replace(regex, subst);
console.log('Substitution result: ', result);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for JavaScript, please visit: https://developer.mozilla.org/en/docs/Web/JavaScript/Guide/Regular_Expressions