From 3eb0a0ed57bc9d2c81617e22689bb06e062f5689 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Thu, 31 Oct 2024 11:47:00 -0400
Subject: [PATCH] fix: #12887, strip target attribute from remote posts' html

---
 src/activitypub/mocks.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/activitypub/mocks.js b/src/activitypub/mocks.js
index e1e2e0f581..686196aef2 100644
--- a/src/activitypub/mocks.js
+++ b/src/activitypub/mocks.js
@@ -29,6 +29,9 @@ const sanitizeConfig = {
 	allowedClasses: {
 		'*': [],
 	},
+	allowedAttributes: {
+		a: ['href', 'rel'],
+	},
 };
 
 Mocks.profile = async (actors, hostMap) => {