It looks like the `TABLES` PolicyFactory in [Sanitizers](/OWASP/java-html-sanitizer/blob/master/src/main/java/org/owasp/html/Sanitizers.java) class does not allow the colspan attribute on `td` and `th` elements. I see no reason why it couldn't.