docs: public void filter(String className) throws SecurityException {
          if (blacklist.isListed(className)) {
              throw new SecurityException(format(DESERIALIZATION_ERROR, className));
          }
          // if whitelisting is enabled (either explicit or as a default whitelist), force the whitelist check
          if (useDefaultWhitelist || !whitelist.isEmpty()) {
              if (whitelist.isListed(className)
                      || (useDefaultWhitelist && DEFAULT_WHITELIST.isListed(className))) {
                  return;
              }
              throw new SecurityException(format(DESERIALIZATION_ERROR, className));
          }
      }