permitted = output['intent'] == 'list_orders' and output['status'] in {'open', 'closed'} and type(output['limit']) is int and 1 <= output['limit'] <= 10
check('模型意图和参数通过白名单', permitted)
with sqlite3.connect(':memory:') as db:
    db.executescript("CREATE TABLE orders(id TEXT,status TEXT); INSERT INTO orders VALUES('O-1','open'),('O-2','closed'),('O-3','open');")
    result = db.execute('SELECT id,status FROM orders WHERE status=? ORDER BY id LIMIT ?', (output['status'], output['limit'])).fetchall() if permitted else []
check('参数化查询实际只返回未完成订单', result == [('O-1', 'open'), ('O-3', 'open')])
check('SQL注入字符串不属于状态白名单', "open' OR 1=1 --" not in {'open', 'closed'})
