in log4j-server/src/main/java/org/apache/logging/log4j/server/AbstractSocketServer.java [109:111]
void setAllowedClasses(final List<String> allowedClasses) { this.allowedClasses = allowedClasses; }