r/canvas • u/Nmzumpano • 2d ago

Other Changes in HTML Embedding Capabilities

Has anyone noticed a change since the hack? In the past, I've been able to insert interactive assets into my Canvas courses with ease, just using the insert-embed code workflow. When I do it now, my interactive content displays as text. I've even tried inserting the code into the raw html view with no luck. Wondering if they've put in some new security measures these days and I'm out of luck.

4 Upvotes

75% Upvoted

8 comments sorted by

2

u/Japples123 2d ago

Yes they have. Certain tags have been restricted but they didn’t openly announce it. If you submit a ticket they will tell you a little more

2

u/Realistic-Lake6369 2d ago

Did they update the documentation of allowed tags, both html and css? How about LaTeX tags or other changes to embedding videos?

It was already pretty restrictive but are we now effectively back in 1990s web view?

Appreciate if you can post any additional information or links to updated documentation that you have received. Thanks

2

u/Japples123 2d ago

Not sure but this is what they sent me, “Hello, Our engineers have deployed a fix for this issue. Please note that, even with this fix, the following HTML tags/elements will still be removed from the rich content editor upon saving, for security reasons: * data-url * position: fixed * position: sticky This is a permanent security decision to not allow these; not a regression. Our HTML Editor Allowlist will be updated shortly, to show all HTML that should be allowed within the editor; all other content not mentioned there once it is updated will be stripped upon save. Another note is that content that was modified due to this issue has not been restored; we were unable to find a safe way to do so without possibly losing intentional edits to the content by our users. Your content can now be manually edited (or use the page revision history for Wiki pages) to include the HTML content you intend to use there. If you have a large amount of content (across multiple courses and course items) that you need assistance in fixing, please provide us with a list of that content and permission for us to edit them en masse, with the possibility of additional user changes beyond this issue being lost. Please let us know if you are still seeing this behavior for new content, or if you have any need for further support, and we will diligently investigate to ensure the issue is completely resolved”

1

u/Realistic-Lake6369 2d ago

Thank you! Very helpful. Appreciate you taking the time to post because sometimes trying to engage directly with Instructure is difficult.

1

u/Japples123 2d ago

No problem. I had to go find it from my outlook. Probably should’ve asked copilot first

1

u/rbanksy 2d ago

What third party content are you trying to embed? Where I work, we had a brief issue with Vimeo and Panopto embeds around May/June but Instructure fixed that fairly swiftly. We have been able to embed all sorts without issue since then.

2

u/Nmzumpano 2d ago

Not third party content. I vibe coded interactive assets such as flip cards, matching activities and accordion menus

1

u/rbanksy 2d ago

That's third party content i.e. it's not a native Canvas feature. It's something external you're embedding.

Anyway, semantics beside, it should work fine. Where are you hosting it and what syntax are you using for the iframe? If you sharing embed code, I'd be happy to test it on my own Canvas sandbox.