Too bad the closing slash doesn't do anything. <script src="..." /> will break horribly if you try to use it. Everything still depends on the whitelist.