fix(web): img attributes sanitization

[hejsztynx]

Summary

• web's sanitization stripped img's height and weight attributes when sanitizationConfig.linkRegex was defined, as those attributes were tested as URIs
• img placeholder now is displayed, even when no src is present in the img element
• added relevant regression tests
• updated the web example-app with a more practical sanitizationConfig.linkRegex [web] <img> tag attributes are ignored during HTML export #741

Test Plan

add some images in the input and push them to the EnrichedText - that will trigger sanitization. Everything should be at its place

Compatibility

OS	Implemented
iOS	❌
Android	❌
Web	✅

Checklist

• E2E tests are passing
• Required E2E tests have been added (if applicable)

[Copilot]

Pull request overview

This PR fixes a web sanitization edge case where <img> dimension attributes were being stripped when a custom sanitizationConfig.linkRegex was supplied, ensures “broken image” styling also applies to images with missing/empty src, and adds regression tests to prevent reintroduction.

Changes:

• Treat <img> width/height as URI-safe attributes during DOMPurify sanitization so they survive custom ALLOWED_URI_REGEXP settings.
• Expand broken-image placeholder styling to cover <img> elements with missing/empty src.
• Add targeted sanitization regression tests and update the example web app’s sanitization regex.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/web/sanitization/htmlSanitizer.ts	Adds width/height to DOMPurify URI-safe attributes to avoid incorrect stripping under custom link regex.
src/web/EnrichedText.css	Applies broken-image placeholder styling when src is missing or empty.
src/web/tests/sanitization.test.ts	Adds regression tests for <img> sanitization behavior under default and custom linkRegex.
apps/example-web/src/components/TextRenderer.tsx	Updates example renderer’s sanitization regex to URL-only.
apps/example-web/src/App.tsx	Updates example app’s sanitization config link regex (but currently diverges from the editor’s linkRegex).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[kacperzolkiewski]

Is this correct behaviour that href attribute is stripped from a tag?

Screen.Recording.2026-08-04.at.13.15.42.mov

[hejsztynx]

Is this correct behaviour that href attribute is stripped from a tag?

Screen.Recording.2026-08-04.at.13.15.42.mov

Good catch, now sanitizationConfig.linkRegex should be equivalent to the autolink detection linkRegex + any links with http and https protocols, so img's src are preserved