Comment 4 for bug 1812353

The list applies to decoded URLs, not encoded (as apt has to decode redirect targets due to technical reasons). It's possible curly braces could occur on redirects. It's highly likely & is involved.

The list as is is all printable characters, and goes way above filtering in other software.

We should get apt fixed to not decode and reencode on redirects, but it's a bit complicated.