[Ur] Supporting 'style' attribute securely

[Adam Chlipala]

A number of folks have asked to be able to use the HTML 'style' 
attribute in Ur/Web.  It's easy enough to add the attribute with type 
[string], but this seems likely to allow for some sort of code injection 
attack.  At a minimum, URL's can appear in styles and be interpreted as 
URL's, which seems to function as a "universal interpreter" for whatever 
programming languages browsers want to support via URL's!  (At a 
minimum, there are "javascript:" URL's.)

So, any suggestions on "the right way" to support 'style' in Ur/Web?  
I'm unlikely to accept an idea that leaves open code injection 
vulnerabilities; one important global guarantee of Ur/Web is that code 
injection attacks are impossible.  But I don't have such a clear idea of 
(a) what the attack possibilities are in CSS style code and (b) what the 
appropriate countermeasures are, including how they should be 
represented with typed combinators in Ur/Web.