It should only add one assertion.
All the 'not alowed' characters can be concatted into one string and tested in one assertion, just like you do with the positive check.