Render arbitrary jade in express
Here are some examples of how most apps do:


Apache renders everything in the folder. If you want to hide access to a subfolder, you do that with an htaccess in this subfolder.
Define each route yourself. This'd mean having a whitelist in your case. (In some array or something.)
Keep the routes in the database. This allows you to handle permissions easily.


I haven't often seen the blacklist way. Why? Because of a simple security principle: blacklists may accidentally treat bad input as safe.