@Override
  public String pattern() {
    return new StringJoiner(";")
        .merge(stringJoiner)

        // reject all others
        .add("!*")

        .toString();
  }
This list contains classes that Geode's classes subclass, such as antlr AST classes which are
used by our Object Query Language. It also contains certain classes that are DataSerializable
but end up being serialized as part of other serializable objects. VersionedObjectList, for
instance, is serialized as part of a partial putAll exception object.

<p>
Do not java-serialize objects that Geode does not have complete control over. This leaves us
open to security attacks such as Gadget Chains and compromises the ability to do a rolling
upgrade from one version of Geode to the next.

<p>
In general, you shouldn't use java serialization, and you should implement
DataSerializableFixedID for internal Geode objects. This gives you better control over
backward-compatibility.

<p>
Do not add to this list unless absolutely necessary. Instead, put your classes either in the
sanctionedSerializables file for your module or in its excludedClasses file. Run
AnalyzeSerializables to generate the content for the file.
geode-serialization/src/main/java/org/apache/geode/internal/serialization/filter/SanctionedSerializablesFilterPattern.java