This document summarizes the investigation into embedding custom JavaScript applications within a Moodle dashboard, showing the initial analysis and the final conclusion based on live testing.
-
No Content-Security-Policy (CSP): The HTTP headers for the Moodle page were missing a
Content-Security-Policy
(CSP) header. A CSP header is the primary browser-level mechanism to control which external resources (like scripts) can be loaded. Its absence suggested that loading external scripts would be possible. -
HTML Sanitization Appears Minimal: An initial test of adding a simple HTML block with
<div>
and<h3>
tags was successful, indicating that Moodle's own sanitization was not overly aggressive.