Good question.  This was a copy/paste from the old system...  a whitelist would indeed be better.