whitelist can use RegExp