NetGraph 1.3.4

Security release. Recommended for everyone, especially if you import maps or
icons shared by other people. Maps look exactly the same as before.

Security

• Custom SVG icons can no longer load external URLs - a crafted icon could
  hide an off-site url(...) in its style or paint attributes by putting a
  quote or ) inside the URL, which slipped past the sanitizer. Opening a map
  that used such an icon made the browser contact the attacker's server,
  revealing your IP address and when you opened it. No script could run and no
  map data left the browser. The check now accepts only plain same-icon
  url(#id) references. Icons already saved in the browser are cleaned the
  next time NetGraph loads, so there's nothing you need to do.
• Added a Content Security Policy - as a second line of defense, the page
  and the offline copy now tell the browser not to load images, scripts or
  anything else from another site, and not to send data anywhere. Even if a
  crafted map or icon ever got past the sanitizer again, it couldn't contact
  an outside server.

Changed

• Updated the Lucide icon set - lucide-static 1.46.0 -> 1.47.0. None of
  the icons NetGraph ships changed, so maps look exactly the same.

Download

netgraph.html below is the entire app in one self-contained file. It runs
from disk or a USB stick, online or air-gapped. Everything stays in the
browser's local storage - no backend, no accounts, no telemetry.

Full changelog: v1.3.3...v1.3.4