I guess a nested, parameter-granularity whitelist would work in that case :)