[ARCHIVED] Has position: fixed been banned?

[and-hu]

In crafting my pages today, I noticed some things I had created using the inline "position: fixed" rule are being overwritten on save to "position: relative". Even trying to bypass this issue through a css rule has the editor adding "position: relative" to my code. 

Why is this happening? There is nothing in the Allow List that says position: fixed is banned. I see nothing about it in release notes. 

All I know is that I had some awesome modals that relied on "position: fixed" and they no longer work and it sucks. I try sooooo hard to make my courses awesome and engaging with what little I can do as a non-admin in a district that does not pay for CidiLabs and Canvas is always messing it up. I hate this CMS. 😢

[and-hu]

So, I went to the repo for Canvas and found that YES, position:fixed has been banned, see the following commit: 

https://github.com/instructure/canvas-lms/commit/b5389273af4002d86160d984f0877875646e4a59 

It would be great if Canvas updated the allow list to make this explicit and also provided some more details about the "security vulnerability," since we obviously don't have access to their JIRA to see it ourselves.