Since asking the question, I've found that the bug is in ASP.NET proper, not IIS or ASP.NET MVC, meaning that there's no way to work around it. The only solution is to manually forbid URLs matching these names and these names followed by a period and random characters.
+15
A:
Benjamin Pollack
2009-06-12 16:36:04
Yup. :) The ASP.NET team is aware of this bug and is looking into it for ASP.NET 4. Can't guarantee if it will be fixed, but at least there is interest in making this better for developers.
Levi
2009-06-13 01:09:40
+3
A:
For a similar reason, there can't be a web.config
tag in StackOverflow.
http://stackoverflow.uservoice.com/pages/1722-general/suggestions/98871-web-config-tag-404-error
Dennis Palmer
2009-06-12 17:25:02
A:
for another similar reason you can't have urls with a dot and a slash http://stackoverflow.com/questions/294495/semantic-urls-with-dots-in-net
Jokin
2009-07-07 21:16:21
+10
A:
This has been addressed in ASP.NET 4. http://haacked.com/archive/2010/04/29/allowing-reserved-filenames-in-URLs.aspx
You can apply a setting in web.config that relaxes this restriction.
<configuration>
<system.web>
<httpRuntime relaxedUrlToFileSystemMapping="true"/>
<!-- ... your other settings ... -->
</system.web>
</configuration>
Hope that helps.
Haacked
2010-04-30 17:29:23