xml whitelists