Do you mind to introduce an option to disable this behavior?

Yes, I'll look into it.

Since this feature is only about images, I would suggest only to attempt downloading images from direct links, i.e. which end with {jpg|bmp|png|tif|...}

TBH, I thought this was already the case, but looks like it isn't.

Do you parse every link or only links that are repeated in the oob tag? (That’s how Conversations differentiates between 'attachments' (HTTP upload) and plain old links that are meant as links).

Also; it might be worth loading images only over HTTPS or it will trigger the 'unsafe elements' warning in the browser. If you decide to only auto load actual attachments (oob url) then limiting oneself to HTTPS isn’t really a problem because HTTP upload has TLS as a MUST anyway.

Currently all links are checked whether they are images. I think a webchat client is subtly different from a mobile client in that people will more regularly just paste an image URL (which means it's not send as OOB) and then expect that image to render inline.

Concerning HTTP, we can probably add a button to be clicked to render the image inline (like on Conversations in some cases).

There's now a new boolean option show_images_inline.

Besides this, Converse will only try to load as images those URLs that have a filename ending in one of the well-known image extensions.