i think, that

```jinja
<hr class="bar" />
<hr class="{{ bar }} />
<script>alert('xx')</script>

<script>alert('{{ bar }}')</script>
```
should became:

```jinja
<hr class="bar" />
<hr class="{{bar | escape ('html_attr')}} />
<script>alert('xx')</script>

<script>alert('{{ bar | escape('js') }}')</script> or <script>{% autoescape 'js' %}alert('{{ bar }}'){% endeutoescape %}</script>
```

`script` second option should be easier to implement