sanitization: restore missed src attr into img tag