<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">I was thinking of just leaving
'http-equiv' out of the attribute list! Is there a reason to
prefer <meta http-equiv="X-UA-Compatible"> over setting that
header in the HTTP response?<br>
<br>
The character set is already set to UTF-8 in the HTTP response, so
I think the first <meta> below is not important.<br>
<br>
The viewport example is the one I'm already aware of. It's a bit
lame that the same can't be done with CSS or an HTTP response
header!<br>
<br>
On 04/15/2016 08:24 PM, <a class="moz-txt-link-abbreviated" href="mailto:foldr@tutanota.com">foldr@tutanota.com</a> wrote:<br>
</div>
<blockquote cite="mid:KFRRztY--3-0@tutanota.com" type="cite">
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
The most obvious choice is whitelisting, at least for for
http-equiv, because the specification is relatively complex.<br>
<a moz-do-not-send="true"
href="https://www.w3.org/TR/html401/struct/global.html#edef-META"
target="_blank">https://www.w3.org/TR/html401/struct/global.html#edef-META</a><br>
<br>
Whitelisting for name attribute might be less usable, but I do not
know whether it is important to add keywords for search engines
these days. Probably not.<br>
<a moz-do-not-send="true"
href="https://www.w3.org/TR/html401/appendix/notes.html#recs"
target="_blank">https://www.w3.org/TR/html401/appendix/notes.html#recs</a><br>
<br>
Personally I am interested to see support for the use cases below.<br>
<meta charset="utf-8"/><br>
<meta http-equiv="X-UA-Compatible" content="IE=edge"/><br>
<meta name="viewport" content="width=device-width,
initial-scale=1.0"/><br>
<br>
At the moment I just define meta as <br>
val meta : unit -> tag [Nam = string, Content = string,
Http_equiv = string, Charset = string] head [] [] []<br>
<br>
<br>
16. Apr 2016 10:35 by <a moz-do-not-send="true"
href="mailto:adamc@csail.mit.edu" target="_blank">adamc@csail.mit.edu</a>:<br>
<br>
<blockquote class="tutanota_quote" style="border-left: 1px solid
#93A3B8; padding-left: 10px; margin-left: 5px;">Someone recently
requested a nice way to include a <meta name="viewport"
content="..."> tag in Ur/Web. It doesn't seem safe to expose
<meta> in its most general form, with type [string] for
each attribute, since it seems like browsers could interpret
those strings in quite arbitrary ways, which goes against
Ur/Web's philosophy about implicit interpretation of strings as
programs.<br>
<br>
Are there any opinions, then, on the right way to expose this
tag?<br>
<br>
My first thought is to add an application-level whitelist of
which <meta> names are allowed, just as with HTTP header
names. Then the 'content' attribute could be exposed as
[string], while the 'name' attribute would have an abstract type
of allowable names. The programmer would need to be careful not
to whitelist names that can lead to mayhem.<br>
</blockquote>
</blockquote>
</body>
</html>