use strict;
use warnings;
use Template;
use Template::Plugin::JavaScript;
use Template::Plugin::JSON::Escape;
use JSON;

my $tt = Template->new;

my $vars = {
    value => '<foo>',
    hash => {foo => '<bar>'},
    jsonstr => encode_json({foo => '<baz>'}),
};

$tt->process(\(my $tmpl =<<'TMPL'), $vars) or die $tt->error;
[% USE JavaScript -%]
[% USE JSON.Escape -%]
<script>
var value = '[% value | html | js %]';
var hash = [% hash.json %];
var hash = [% jsonstr | json %];
</script>
TMPL

use strict;
use warnings;
use Template;
use Template::Directive::XSSAudit;

my $tt = Template->new({
    FACTORY => 'Template::Directive::XSSAudit',
});

$tt->process(\(my $tmpl =<<'TMPL'), {tag => '<foo>'}) or die $tt->error;
[% USE JavaScript -%]
<div>[% tag %]</div>
<div>[% tag | html %]</div>
<script>var value='[% tag | js %]'</script>
TMPL

<unknown_file>  NO_FILTERS      line:0  tag
<unknown_file>  NO_SAFE_FILTER  line:0  tag     js
<div><foo></div>
<div>&lt;foo&gt;</div>
<script>var value='\x3cfoo\x3e'</script>

use strict;
use warnings;
use Template;
use Template::Directive::XSSAudit;

my $tt = Template->new({
    FACTORY => 'Template::Directive::XSSAudit',
});

Template::Directive::XSSAudit->on_filtered(sub {
    my $e = shift;
    if ($e->{variable_name} =~ /_js/) {
        unless (grep { $_ eq 'js' }, @{ $e->{filtered_by} || [] }) {
            my $file = $e->{file_name} || '<unknown file>';
            my $line = $e->{file_line} || 0;
            warn "$file\tREQUIRES JS FILTER\tline:$line\t$e->{variable_name}\n";
        }
    }
});

$tt->process(\(my $tmpl =<<'TMPL'), {value_js => q/'+alert(1)+'/}) or die $tt->error;
[% USE JavaScript -%]
<script>
var value = '[% value_js | html %]';
var value = '[% value_js | html | js %]';
</script>
TMPL

use strict;
use warnings;
use Template::AutoFilter;

my $tt = Template::AutoFilter->new;

$tt->process(\(my $tmpl =<<'TMPL'), {tag => '<foo>'}) or die $tt->error;
[% USE JavaScript -%]
<div>[% tag %]</div>
<div>[% tag | none %]</div>
<script>var value='[% tag | html | js %]'</script>
TMPL