@ddumonde  

There is a CSS Whitelist; it's included as part of the Canvas HTML Editor Allowlist. It includes HTML tags, MathML tags, attributes on HTML elements, and style properties that are allowed. Others are disallowed.

At the very bottom is a list of allowed style properties. Box-shadow is not allowed.

The old Rich Content Editor normally does a good job of stripping out values that are not allowed. I haven't played with the new Rich Content Editor yet.  Either way, the content is sanitized on the server end when the content is uploaded to Canvas.

If you need box shadows or CSS that is not allowed, then you will need to partner with your local Canvas Admin to create CSS classes that you can use.