Did this ever work? I found out that almost none of the attributes get passed through the API

No

even if this worked jeffalo’s dompurify would cut the invalid src and possibly the onerror @jeffalo pls confirm