IIS Reverse Proxy Introduces a "Cannot use a leading .. to exit above the top directory" in specific instances

So, like a few million other folks, we've got an ASP.NET MVC web app featuring a custom 404 page -- in our case /Errors/NotFound . Recently we moved the site behind an IIS 7.5 reverse proxy for a few reasons. Generally this has worked perfectly, except for one odd case -- 1st level 404 errors generate a HttpException for "Cannot use a leading .. to exit above the top directory." but only when punched through the proxy. Meaning:

a) http://example.com/not/a/page gets the correct 404 error page.

b) http://example.com/not-a-page gets a yellow screen of death for the above mentioned error.

c) if I skip the proxy and go to http://10.1.1.80/not-a-page I get the correct 404 error page.

I did some digging inside the exception, and I'm starting to think the error is coming from our reference to our ScriptIncludes.aspx partial view from the Master Page, but it doesn't seem to start executing that control from what I can tell. Any ideas?

UPDATE

Did a bit more messing around, now have the problem isolated down to a call to Url.Action, or really the underlying stack trace here:

[HttpException (0x80004005): Cannot use a leading .. to exit above the top directory.] System.Web.Util.UrlPath.ReduceVirtualPath(String path) +8857926 System.Web.Util.UrlPath.Reduce(String path) +52

System.Web.Util.UrlPath.Combine(String appPath, String basepath, String relative) +217 System.Web.VirtualPath.Combine(VirtualPath relativePath) +130 System.Web.VirtualPath.Combine(VirtualPath v1, VirtualPath v2) +53 System.Web.VirtualPathUtility.Combine(String basePath, String relativePath) +39

System.Web.Mvc.PathHelpers.MakeAbsolute(String basePath, String relativePath) +61

System.Web.Mvc.PathHelpers.GenerateClientUrlInternal(HttpContextBase httpContext, String contentPath) +424

System.Web.Mvc.PathHelpers.GenerateClientUrl(HttpContextBase httpContext, String contentPath) +87

System.Web.Mvc.UrlHelper.GenerateUrl(String routeName, String actionName, String controllerName, RouteValueDictionary routeValues, RouteCollection routeCollection, RequestContext requestContext, Boolean includeImplicitMvcValues) 开发者_StackOverflow社区+295

System.Web.Mvc.UrlHelper.GenerateUrl(String routeName, String actionName, String controllerName, RouteValueDictionary routeValues) +99 System.Web.Mvc.UrlHelper.Action(String actionName, String controllerName, Object routeValues) +69

ASP.views_shared_masters_scriptincludes_ascx._Render_control1(HtmlTextWriter __w, Control parameterContainer) in CENSORED\ScriptIncludes.ascx:2 System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) +109

System.Web.UI.Control.RenderChildren(HtmlTextWriter writer) +8

System.Web.UI.Control.Render(HtmlTextWriter writer) +10

System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) +27

System.Web.UI.Control.RenderControl(HtmlTextWriter writer, ControlAdapter adapter) +100

System.Web.UI.Control.RenderControl(HtmlTextWriter writer) +25

System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) +208

System.Web.UI.Control.RenderChildren(HtmlTextWriter writer) +8

System.Web.UI.Page.Render(HtmlTextWriter writer) +29

System.Web.Mvc.ViewPage.Render(HtmlTextWriter writer) +56

System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) +27

System.Web.UI.Control.RenderControl(HtmlTextWriter writer, ControlAdapter adapter) +100

System.Web.UI.Control.RenderControl(HtmlTextWriter writer) +25

System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +3060

And it definitely has something to do with the URL rewriting.