diff --git a/core/core.api.php b/core/core.api.php
index 5bd73fda950..20ae75cd126 100644
--- a/core/core.api.php
+++ b/core/core.api.php
@@ -764,7 +764,7 @@
  * @code
  * path_alias.manager:
  *   class: Drupal\path_alias\AliasManager
- *   arguments: ['@path_alias.repository', '@path_alias.whitelist', '@language_manager']
+ *   arguments: ['@path_alias.repository', '@path_alias.prefix_list', '@language_manager']
  * @endcode
  * Some services use other services as factories; a typical service definition
  * is:
diff --git a/core/modules/path/tests/src/Functional/PathAliasTest.php b/core/modules/path/tests/src/Functional/PathAliasTest.php
index 617e58722de..1c196dcdd54 100644
--- a/core/modules/path/tests/src/Functional/PathAliasTest.php
+++ b/core/modules/path/tests/src/Functional/PathAliasTest.php
@@ -44,8 +44,8 @@ class PathAliasTest extends PathTestBase {
     ]);
     $this->drupalLogin($web_user);
 
-    // The \Drupal\path_alias\AliasWhitelist service performs cache clears after
-    // Drupal has flushed the response to the client. We use
+    // The \Drupal\path_alias\AliasPrefixList service performs cache clears
+    // after Drupal has flushed the response to the client. We use
     // WaitTerminateTestTrait to wait for Drupal to do this before continuing.
     $this->setWaitForTerminate();
   }
@@ -64,7 +64,7 @@ class PathAliasTest extends PathTestBase {
     $this->drupalGet('admin/config/search/path/add');
     $this->submitForm($edit, 'Save');
 
-    // Check the path alias whitelist cache.
+    // Check the path alias prefix list cache.
     $prefix_list = \Drupal::cache('bootstrap')->get('path_alias_prefix_list');
     $this->assertTrue($prefix_list->data['node']);
     $this->assertFalse($prefix_list->data['admin']);
diff --git a/core/modules/views/tests/src/Functional/Plugin/DisplayFeedTranslationTest.php b/core/modules/views/tests/src/Functional/Plugin/DisplayFeedTranslationTest.php
index f456f521c04..5feef69641b 100644
--- a/core/modules/views/tests/src/Functional/Plugin/DisplayFeedTranslationTest.php
+++ b/core/modules/views/tests/src/Functional/Plugin/DisplayFeedTranslationTest.php
@@ -85,8 +85,8 @@ class DisplayFeedTranslationTest extends ViewTestBase {
     // that hold a list of languages.
     $this->rebuildContainer();
 
-    // The \Drupal\path_alias\AliasWhitelist service performs cache clears after
-    // Drupal has flushed the response to the client. We use
+    // The \Drupal\path_alias\AliasPrefixList service performs cache clears
+    // after Drupal has flushed the response to the client. We use
     // WaitTerminateTestTrait to wait for Drupal to do this before continuing.
     $this->setWaitForTerminate();
   }
diff --git a/core/modules/workspaces/tests/src/Functional/PathWorkspacesTest.php b/core/modules/workspaces/tests/src/Functional/PathWorkspacesTest.php
index 9144c1eb0bf..66dd6864217 100644
--- a/core/modules/workspaces/tests/src/Functional/PathWorkspacesTest.php
+++ b/core/modules/workspaces/tests/src/Functional/PathWorkspacesTest.php
@@ -74,8 +74,8 @@ class PathWorkspacesTest extends BrowserTestBase {
 
     $this->setupWorkspaceSwitcherBlock();
 
-    // The \Drupal\path_alias\AliasWhitelist service performs cache clears after
-    // Drupal has flushed the response to the client. We use
+    // The \Drupal\path_alias\AliasPrefixList service performs cache clears
+    // after Drupal has flushed the response to the client. We use
     // WaitTerminateTestTrait to wait for Drupal to do this before continuing.
     $this->setWaitForTerminate();
   }
diff --git a/core/tests/Drupal/KernelTests/Core/Theme/TwigWhiteListTest.php b/core/tests/Drupal/KernelTests/Core/Theme/TwigAllowListTest.php
similarity index 94%
rename from core/tests/Drupal/KernelTests/Core/Theme/TwigWhiteListTest.php
rename to core/tests/Drupal/KernelTests/Core/Theme/TwigAllowListTest.php
index a34dc73edea..3cd4bab11da 100644
--- a/core/tests/Drupal/KernelTests/Core/Theme/TwigWhiteListTest.php
+++ b/core/tests/Drupal/KernelTests/Core/Theme/TwigAllowListTest.php
@@ -14,11 +14,11 @@ use Drupal\taxonomy\Entity\Term;
 use Drupal\taxonomy\Entity\Vocabulary;
 
 /**
- * Tests white-listing of entity properties.
+ * Tests the allowed list of entity properties.
  *
  * @group Theme
  */
-class TwigWhiteListTest extends KernelTestBase {
+class TwigAllowListTest extends KernelTestBase {
 
   /**
    * Term for referencing.
@@ -119,9 +119,9 @@ class TwigWhiteListTest extends KernelTestBase {
   }
 
   /**
-   * Tests white-listing of methods doesn't interfere with chaining.
+   * Tests listing of methods doesn't interfere with chaining.
    */
-  public function testWhiteListChaining(): void {
+  public function testAllowListChaining(): void {
     /** @var \Drupal\Core\Template\TwigEnvironment $environment */
     $environment = \Drupal::service('twig');
     $node = Node::create([
diff --git a/core/tests/Drupal/Tests/Component/Utility/XssTest.php b/core/tests/Drupal/Tests/Component/Utility/XssTest.php
index 6f8e09425b0..617fb5225b2 100644
--- a/core/tests/Drupal/Tests/Component/Utility/XssTest.php
+++ b/core/tests/Drupal/Tests/Component/Utility/XssTest.php
@@ -300,7 +300,7 @@ class XssTest extends TestCase {
         'HTML filter attributes removal evasion -- breaking with nulls.',
         ['img'],
       ],
-      // Only whitelisted scheme names allowed in attributes.
+      // Only allowed scheme names allowed in attributes.
       [
         '<img src="javascript:alert(0)">',
         'javascript',
diff --git a/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php b/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php
index 59f17d3e15f..fac5aa01b76 100644
--- a/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php
+++ b/core/tests/Drupal/Tests/Core/Security/RequestSanitizerTest.php
@@ -56,12 +56,12 @@ class RequestSanitizerTest extends UnitTestCase {
    * @param array|null $expected_errors
    *   An array of expected errors. If set to NULL then error logging is
    *   disabled.
-   * @param array $whitelist
-   *   An array of keys to whitelist and not sanitize.
+   * @param array $allow_list
+   *   An array of keys to allow and not sanitize.
    *
    * @dataProvider providerTestRequestSanitization
    */
-  public function testRequestSanitization(Request $request, array $expected = [], ?array $expected_errors = NULL, array $whitelist = []): void {
+  public function testRequestSanitization(Request $request, array $expected = [], ?array $expected_errors = NULL, array $allow_list = []): void {
     // Set up globals.
     $_GET = $request->query->all();
     $_POST = $request->request->all();
@@ -70,7 +70,7 @@ class RequestSanitizerTest extends UnitTestCase {
     $request->server->set('QUERY_STRING', http_build_query($request->query->all()));
     $_SERVER['QUERY_STRING'] = $request->server->get('QUERY_STRING');
 
-    $request = RequestSanitizer::sanitize($request, $whitelist, is_null($expected_errors) ? FALSE : TRUE);
+    $request = RequestSanitizer::sanitize($request, $allow_list, is_null($expected_errors) ? FALSE : TRUE);
 
     // Normalize the expected data.
     $expected += ['cookies' => [], 'query' => [], 'request' => []];
@@ -160,10 +160,10 @@ class RequestSanitizerTest extends UnitTestCase {
     $tests['recursive sanitization log'] = [$request, ['query' => ['q' => 'index.php', 'foo' => []]], ['Potentially unsafe keys removed from query string parameters (GET): #bar']];
 
     $request = new Request(['q' => 'index.php', 'foo' => ['#bar' => 'foo']]);
-    $tests['recursive no sanitization whitelist'] = [$request, ['query' => ['q' => 'index.php', 'foo' => ['#bar' => 'foo']]], [], ['#bar']];
+    $tests['recursive no sanitization allowed list'] = [$request, ['query' => ['q' => 'index.php', 'foo' => ['#bar' => 'foo']]], [], ['#bar']];
 
     $request = new Request([], ['#field' => 'value']);
-    $tests['no sanitization POST whitelist'] = [$request, ['request' => ['#field' => 'value']], [], ['#field']];
+    $tests['no sanitization POST allowed list'] = [$request, ['request' => ['#field' => 'value']], [], ['#field']];
 
     $request = new Request(['q' => 'index.php', 'foo' => ['#bar' => 'foo', '#foo' => 'bar']]);
     $tests['recursive multiple sanitization log'] = [$request, ['query' => ['q' => 'index.php', 'foo' => []]], ['Potentially unsafe keys removed from query string parameters (GET): #bar, #foo']];
@@ -194,7 +194,7 @@ class RequestSanitizerTest extends UnitTestCase {
     $tests['destination removal subkey'] = [$request];
 
     $request = new Request(['destination' => 'whatever?q[%23test]=value']);
-    $tests['destination whitelist'] = [$request, ['query' => ['destination' => 'whatever?q[%23test]=value']], [], ['#test']];
+    $tests['destination allowed list'] = [$request, ['query' => ['destination' => 'whatever?q[%23test]=value']], [], ['#test']];
 
     $request = new Request(['destination' => "whatever?\x00bar=base&%23test=value"]);
     $tests['destination removal zero byte'] = [$request];
diff --git a/core/tests/Drupal/Tests/Core/Template/TwigSandboxTest.php b/core/tests/Drupal/Tests/Core/Template/TwigSandboxTest.php
index 9af863dcc85..4fdeae02e12 100644
--- a/core/tests/Drupal/Tests/Core/Template/TwigSandboxTest.php
+++ b/core/tests/Drupal/Tests/Core/Template/TwigSandboxTest.php
@@ -105,8 +105,8 @@ class TwigSandboxTest extends UnitTestCase {
   /**
    * Tests that valid methods can be called from within Twig templates.
    *
-   * Currently the following methods are whitelisted: id, label, bundle, and
-   * get.
+   * Currently the following methods are in the allowed list: id, label, bundle,
+   * and get.
    */
   public function testEntitySafeMethods(): void {
     $entity = $this->getMockBuilder(ContentEntityBaseMockableClass::class)