Only target=_blank is allowed

- _new and _blank => _blank
- everything else, drops the target attribute

includes/sanitizers/class-amp-blacklist-sanitizer.php

@@ -92,9 +92,14 @@ private function sanitize_a_attribute( $node, $attribute ) {
 		} elseif ( 'rev' === $attribute_name ) {
 			// rev removed from HTML5 spec, which was used by Jetpack Markdown.
 			$node->removeAttribute( $attribute_name );
-		} elseif ( 'target' === $attribute_name && '_new' === $attribute->value ) {
-			// _new is not allowed; swap with _blank
-			$node->setAttribute( $attribute_name, '_blank' );
+		} elseif ( 'target' === $attribute_name ) {
+		       if ( '_blank' === $attribute->value || '_new' === $attribute->value ) {
+			       // _new is not allowed; swap with _blank
+			       $node->setAttribute( $attribute_name, '_blank' );
+		       } else {
+			       // only _blank is allowed
+			       $node->removeAttribute( $attribute_name );
+		       }
 		}
 	}
 

tests/test-amp-blacklist-sanitizer.php

@@ -87,6 +87,21 @@ public function get_data() {
 				'<a href="http://example.com" target="_new">Link</a>',
 				'<a href="http://example.com" target="_blank">Link</a>',
 			),
+
+			'a_with_target_blank' => array(
+				'<a href="http://example.com" target="_blank">Link</a>',
+				'<a href="http://example.com" target="_blank">Link</a>',
+			),
+
+			'a_with_target_self' => array(
+				'<a href="http://example.com" target="_self">Link</a>',
+				'<a href="http://example.com">Link</a>',
+			),
+
+			'a_with_target_invalid' => array(
+				'<a href="http://example.com" target="boom">Link</a>',
+				'<a href="http://example.com">Link</a>',
+			),
 		);
 	}