Definition
Allow-list Validation
Allow-list validation accepts input only if it matches a set of known-good values (or shapes). It is the safe counterpart of block-list validation, which tries to enumerate forbidden patterns and is routinely bypassed — for example, filtering
../to defeat path traversal misses..././.Prefer allow-lists whenever the input space is small or well-defined: a fixed set of page names, an alphanumeric character class, a known host. When inclusion is dynamic, supplement the allow-list with a structure check such as a canonical path prefix test.