appendix: 23 Code-Ausschnitte aus dem Houston-Repository

Pin nixpkgs to the revision used by itc.componentware: the channel version
ships a latexminted that crashes on Python 3.14, which made every listing
fail and sent latexmk into an endless error prompt. Also force
nonstopmode/halt-on-error so a broken listing can never loop again.

figures/code/test-path-traversal.cs

@@ -0,0 +1,12 @@
+[Theory]
+[InlineData("../Kunde2/secret.pdf")]
+[InlineData("sub/../../Kunde2/secret.pdf")]
+public void DocumentIdTryParseRejectsPathTraversal(string relativePath)
+{
+    Assert.False(new DocumentId(UnsafeDocumentIdValue(relativePath)).TryDecode(out _));
+}
+
+
+// Test-Hilfsfunktion: erzeugt bewusst eine ID, die die Validierung umgeht.
+private static string UnsafeDocumentIdValue(string relativePath)
+    => WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(relativePath));