diff --git a/javascript/ql/src/semmle/javascript/HTML.qll b/javascript/ql/src/semmle/javascript/HTML.qll
index 064bc813538..d399cde4a84 100644
--- a/javascript/ql/src/semmle/javascript/HTML.qll
+++ b/javascript/ql/src/semmle/javascript/HTML.qll
@@ -159,6 +159,40 @@ module HTML {
* if it can be determined.
*/
Script resolveSource() { result.getFile().getAbsolutePath() = resolveSourcePath() }
+
+ /**
+ * Gets the inline script of this script element, if any.
+ */
+ private InlineScript getInlineScript() {
+ exists(string f, Location l1, int sl1, int sc1, int el1, int ec1, Location l2, int sl2, int sc2, int el2, int ec2 |
+ l1 = getLocation() and
+ l2 = result.getLocation() and
+ l1.hasLocationInfo(f, sl1, sc1, el1, ec1) and
+ l2.hasLocationInfo(f, sl2, sc2, el2, ec2)
+ |
+ (
+ sl1 = sl2 and sc1 < sc2
+ or
+ sl1 < sl2
+ ) and
+ (
+ el1 = el2 and ec1 > ec2
+ or
+ el1 > el2
+ )
+ ) and
+ // the src attribute has precedence
+ not exists(getSourcePath())
+ }
+
+ /**
+ * Gets the script of this element, if it can be determined.
+ */
+ Script getScript() {
+ result = getInlineScript() or
+ result = resolveSource()
+ }
+
}
/**
diff --git a/javascript/ql/test/library-tests/HTML/HtmlScript/ScriptElement_getScript.expected b/javascript/ql/test/library-tests/HTML/HtmlScript/ScriptElement_getScript.expected
new file mode 100644
index 00000000000..f0d2ecd7fc0
--- /dev/null
+++ b/javascript/ql/test/library-tests/HTML/HtmlScript/ScriptElement_getScript.expected
@@ -0,0 +1,4 @@
+| tst.html:2:3:2:32 |
+
+
+
+
+
+
+
+