Clarification: 1.3.6 "dangerous characters"

Verify that the application protects against Server‑side Request Forgery
(SSRF) attacks, by validating untrusted data against an allowlist of protocols,
domains, paths and ports and sanitizing potentially dangerous characters
before using the data to call another service.

"Sanitizing Potentially Dangerous Characters"

• What characters are considered as "dangerous'?
• Why sanitization is important? I am having difficulty find the information about sanitization for SSRF, I have referered Below URL:

As far as I know, the sanitization is not the primary defense. the requirement doesn’t specify how granular or strict the allow list should be and also other important terms are missing in the requirement.

Read the referenced ASVS 5.0 requirement and its raw Markdown source, then compare the linked SSRF references and the discussion in this issue. Determine whether the wording should define dangerous characters, explain sanitization, or clarify the requirement's scope; done means an agreed clarification is reflected in the requirement text.