WebUI: allow target="_blank" by default in parseHtmlSubset().

ui/webui/resources/js/parse_html_subset.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * Parse a very small subset of HTML.  This ensures that insecure HTML /
  * javascript cannot be injected into the new tab page.
  * @param {string} s The string to parse.
  * @param {Array<string>=} opt_extraTags Optional extra allowed tags.
  * @param {Object<function(Node, string):boolean>=} opt_extraAttrs
  *     Optional extra allowed attributes (all tags are run through these).
  * @throws {Error} In case of non supported markup.
  * @return {DocumentFragment} A document fragment containing the DOM tree.
  */
 var parseHtmlSubset = (function() {
   'use strict';
 
   var allowedAttributes = {
     'href': function(node, value) {
       // Only allow a[href] starting with chrome:// and https://
       return node.tagName == 'A' && (value.indexOf('chrome://') == 0 ||
           value.indexOf('https://') == 0);
     },
     'target': function(node, value) {
-      // Allow a[target] but reset the value to "".
-      if (node.tagName != 'A')
-        return false;
-      node.setAttribute('target', '');
-      return true;
-    }
+      // Only allow a[target='_blank'].
+      // TODO(dbeam): are there valid use cases for target != '_blank'?
+      return node.tagName == 'A' && value == '_blank';
+    },
   };
 
   /**
    * Whitelist of tag names allowed in parseHtmlSubset.
    * @type {!Array<string>}
    * @const
    */
   var allowedTags = ['A', 'B', 'STRONG'];
 
   /** @param {...Object} var_args Objects to merge. */
@@ skipping 55 matching lines @@
         case Node.TEXT_NODE:
           break;
 
         default:
           throw Error('Node type ' + node.nodeType + ' is not supported');
       }
     });
     return df;
   };
 })();