added src as whitelisted attribute