[fix #1467] Make sure target attribute is kept after DOMPurify sanitization

Author: Fabien Quatravaux

src/core/render/index.js

@@ -330,7 +330,10 @@ export function renderMixin(proto) {
           },
           tokens => {
             html = this.compiler.compile(tokens);
-            html = this.isRemoteUrl ? DOMPurify.sanitize(html) : html;
+            // add "target" attribute to DOMPurify white list to handle external links
+            html = this.isRemoteUrl
+              ? DOMPurify.sanitize(html, { ADD_ATTR: ['target'] })
+              : html;
             callback();
             next();
           }