Text: target="_blank" gets stripped from injected HTML values

[joepavitt]

Current Behavior

• The rendered <a /> has the target="_blank" removed.
• Adding other attributes is fine, it's just the target that seems to get stripped.

Expected Behavior

• If the HTML has attributes, such as target defined, these should not be stripped.

Steps To Reproduce

Copy the example from our docs, inject it into a UI Text under msg.payload

Environment

• Dashboard version: 1.19.1
• Node-RED version: 4.x

Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate

[m-schaeffler]

I have similar code in my project and just tested it: Issue also reproduced here.