URL、审批与数据最小化：练习答案
参考实现
在正文URL实验后追加：
python
assert not allowed_url("https://docs.example.com:8080/")
assert not allowed_url("https://u:p@docs.example.com/")
def safe_event(raw):
if raw.get("event") not in {"tool_ok","tool_denied"}:raise ValueError("unknown event")
if type(raw.get("duration_ms")) is not int or raw["duration_ms"]<0:raise ValueError("invalid duration")
return {"event":raw["event"],"duration_ms":raw["duration_ms"]}
assert safe_event({"event":"tool_ok","duration_ms":3,"prompt":"private","secret":"key","error":"private"}) == {"event":"tool_ok","duration_ms":3}
print("bounded telemetry")不仅限制字段名，还限制值的形状；否则攻击内容仍可塞入event字段。