this seem solvable if the whitelisting just allows regex