whitelist accepts array/string and globstar