$(20)$ Use whitelisting to specify exactly what is allowed. Whitelisting is a pessimistic technique in that by default it denies everything except for those things explicitly allowed. Apply whitelisting to resolve this vulnerability by reading a whitelist.json file that has in it the roles and the set of whitelist terms allowed for that role.

$[$

$\{$

$\},\{$

$\},\{$

$\}]$

"role": "admin",

"whitelist": $["$TERM$1",$ "TERM$2",...]$

"role": "developer",

"whitelist": $["$TERM$3",$ "TERM$4",...]$

"role": "user",

"whitelist": $["$TERM$5",$ "TERM$6",...]$

Then use ProcessBuilder