That is why I added the validation code - .. and / are not letter or digits.

if (pageName == null || pageName.Any(c => !Char.IsLetterOrDigit(c)))
> +            {
> +                return HttpNotFound();
> +            }