"Tested" with Trix 0.9.4

trix-sanitize-html.js

var sanitizeHtml = require('sanitize-html');

function localSanitizeHtml(html) {
  let allowedAttributes = JSON.parse(JSON.stringify(sanitizeHtml.defaults.allowedAttributes));
  allowedAttributes.a = (allowedAttributes.a || []).concat(['data-trix-attachment', 'rel']);
  allowedAttributes.figure = (allowedAttributes.figure || []).concat(['class']);
  allowedAttributes.figcaption = (allowedAttributes.figcaption || []).concat(['class']);
  allowedAttributes.img = (allowedAttributes.img || []).concat(['width', 'height']);
  allowedAttributes.span = (allowedAttributes.span || []).concat(['class']);

  return sanitizeHtml(html, {
    allowedTags: sanitizeHtml.defaults.allowedTags.concat(['img', 'figure', 'figcaption', 'span', 'del']),
    allowedAttributes: allowedAttributes,
    transformTags: {
      a: function(tagName, attribs) {
        attribs.target = '_blank';
        attribs.rel = 'noreferrer';
        return { tagName: tagName, attribs: attribs };
      },
    }
  });
}