What characters should be cut in GET requests when writing a server?

Question

Web servers

Good time everyone!
I am writing a small web server,
trying to somehow secure it, and because of ignorance, I think it’s better to ask than later ...
So, if get requests are not parsed in any way, then the user can get any file in the system, for example
: root-path, let it be /var/www/
add to it from get
GET /index.html HTTP/1.1
We get:
/var/www/index.html
Now when requesting
GET /../../etc/shadow HTTP/ 1.1
we give a file with passwords =)
So, because folder in linux cannot contain / or null they need to be cut immediately. Colon cut - for safety's sake. Total three.
What characters did I miss? This means not only characters, but also bytes 0-255

Answer 1

Read the articles "sanitizing URL" and "sanitizing input data" - a lot depends on which software the data received in the URL will be transferred to in the future