How to define if url exists at Magento?

Question

For example I have set of urls, their rewrites, etc:

test1.html
catalog/product.html
thank-you
catalog/product/view/id/34

All this URLs gives 200 OK at response. My aim is to filter incoming URLs and don't allow URLs that do not exists inside Magento (404 response I think).

How can I define that this URL will give 200 OK inside of Magento?

Answer 1

I think the safest way to find out if an URL will give you 200 or 404 (or any other header) is to make a call to that URL. Other than that I don't see a safe way. URLs can be valid (catalog/product/view/id/34) but still give you 404 because the product is disabled or is not visible in that store view. Same goes for CMS pages URLs (test1.html), not to mention that test1.html might be the URL for a custom entity (not a CMS page).

Answer 2

You can get all the product and category page URL's from the built in sitemap (see Mage_Sitemap_Model_Sitemap::generateXml().

For the CMS pages, you will need to get the list of URL's via a CMS page collection

$pages = Mage::getResourceModel('cms/page_collection')->getColumnValues('identifier');

This covers all the "SEF" URL's in Magento, which leaves us with the regular route-controller-action type URL's.

Collecting the list of routes is easy: Mage::getConfig()->getNode()->xpath('./*/routers'), but to actually figure out which controllers with with actions are valid is much more involved.
I suggest you use the existing logic from the standard and the admin router for building a list of controller classes, and the checking each one of those for valid actions.

To load the routers you can use the front controller: Mage::app()->getFrontController()->init();

Then refer to Mage_Core_Controller_Varien_Router_Standard::match() for further details, that is how it validates and instantiates the controllers and checks if an action is present.
You might want to extend the router to have access to the protected list of routes in your custom logic.

Regarding the portion of the request path behind the route/controller/action, e.g. catalog/product/view /id/44, I don't think it's feasible to add a whitelist for those. If the route is valid, I'd hope that the Magento logic is secure enough to correctly handle any arguments.