diff --git a/core/server/models/comment.js b/core/server/models/comment.js index 6ce102fa9f..c268bd447d 100644 --- a/core/server/models/comment.js +++ b/core/server/models/comment.js @@ -51,8 +51,18 @@ const Comment = ghostBookshelf.Model.extend({ const sanitizeHtml = require('sanitize-html'); this.set('html', sanitizeHtml(this.get('html'), { - allowedTags: ['p', 'br'], - selfClosing: ['br'] + allowedTags: ['p', 'br', 'a'], + allowedAttributes: { + a: ['href', 'target', 'rel'] + }, + selfClosing: ['br'], + // Enforce _blank and safe URLs + transformTags: { + a: sanitizeHtml.simpleTransform('a', { + target: '_blank', + rel: 'ugc noopener noreferrer nofollow' + }) + } })); } },