Steps to replicate the issue (include links if applicable):

• Try to use https://en.wikivoyage.org/wiki/MediaWiki:Gadget-Maptool.js (uses overpass)
• Try to use https://en.wikivoyage.org/wiki/MediaWiki:Gadget-TripPlanner.js (uses openrouteservice API)

What happens?:

CSP error is reported when the gadget tries to access the endpoints.

What should have happened instead?:

• Maptool should be able to query OSM POIs via the overpass API
• TripPlanner should be able to query openrouteservice to either get list of routes, or optimize order of POIs

Both services are +- free and I assume safe (although in general, probably XSS could happen with some forged data in their databases, in case the returned stuff was not properly sanitized)...