Right now we have an explicit blacklist of characters; would it be better to have an explicit whitelist? I wonder if this list will continue to grow and if it would be a better long term fix to just lock in safe characters instead.