A developer uses a 'whitelist' approach for input validation: only accept values matching an expected pattern. A security reviewer prefers this over a 'blacklist' approach. Why is allowlisting (whitelisting) fundamentally stronger for security?

• A.An allowlist defines a complete set of acceptable inputs; anything not matching is rejected. A blocklist attempts to enumerate all bad inputs - which is inherently incomplete since attackers can use encoding variants, new attack patterns, and context-specific bypasses not yet in the blocklist. Allowlists have no 'unknown unknowns' because the default is reject
• B.An allowlist is faster than a blocklist: it needs only one regex match, and a blocklist scans for thousands of patterns, so the CPU cost of validation rises with each new rule, which makes the allowlist the preferred control for the high volume endpoints
• C.An allowlist validates the output, and a blocklist validates the input: encoding at the sink needs a list of safe characters, since all output contexts share one safe set, while an input blocklist must track all browser parsers and each legacy character set