WL is a best practice against BL whenever it is practicable.
The reason is simple: you can't be reasonably safe enumerating what it is not permitted, an attacker could always find a way you did not think about. If you can, say what is allowed for sure, it is simpler and much much safer !
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…