    private ObjectStreamClass verify(ObjectStreamClass streamClass) throws IOException, ClassNotFoundException {
        Class<?> aClass = resolveClass(streamClass);
        Package pkg = aClass.getPackage();
        if (aClass.isPrimitive() // primitives are fine
                || aClass.isArray() // arrays are ok too
                || Throwable.class.isAssignableFrom(aClass)// exceptions are fine
                || CLASS_WHITELIST.contains(aClass) // whitelist JDK stuff we need
                || PKG_WHITELIST.contains(aClass.getPackage())
                || pkg.getName().startsWith("org.elasticsearch")) { // es classes are ok
            return streamClass;
        }
        throw new NotSerializableException(aClass.getName());
    }
The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.