wso2 api manager如何保护后端apis(wso2 api manager how to protect backend apis)

 正如文档所说， 它是驾驶员的特殊能力 。 它会自动将cursor[0]转换为cursor.toArray()[0] 。 您可以通过使用print函数覆盖toArray()或使用new Error().stack来证明它，以获得callstack。 这里是： 
 
at DBQuery.a.toArray ((shell):1:32)
at DBQuery.arrayAccess (src/mongo/shell/query.js:290:17)
at (shell):1:2
 
 如您所见，索引调用arrayAccess 。 怎么样？ 这里我们有一个dbQueryIndexAccess函数 ，它调用arrayAccess 。 
 
v8::Handle<v8::Value> arrayAccess = info.This()->GetPrototype()->ToObject()->Get(
                v8::String::New("arrayAccess"));
...
v8::Handle<v8::Function> f = arrayAccess.As<v8::Function>();
...
return f->Call(info.This(), 1, argv);
 
 这里我们有一个代码 ，它为这个函数设置了索引属性处理程序 。 WOW，v8 API让我们能够添加这个处理程序！ 
 
DBQueryFT()->InstanceTemplate()->SetIndexedPropertyHandler(dbQueryIndexAccess);
 
 ...并将其注入到JS游标类中，该游标类最初是在JS中定义的。 
 
injectV8Function("DBQuery", DBQueryFT(), _global);
 
 Tl; dr ：它是用mongo shell的C ++源代码攻击的 。 

As documentation says, it is special ability of driver. It automagicly converts cursor[0] to cursor.toArray()[0]. You can prove it by overriding toArray() with print function or new Error().stack to get callstack back. Here it is:
 
at DBQuery.a.toArray ((shell):1:32)
at DBQuery.arrayAccess (src/mongo/shell/query.js:290:17)
at (shell):1:2
 
As you can see, indexing calls arrayAccess. How? Here we have a dbQueryIndexAccess function, which calls arrayAccess. 
 
v8::Handle<v8::Value> arrayAccess = info.This()->GetPrototype()->ToObject()->Get(
                v8::String::New("arrayAccess"));
...
v8::Handle<v8::Function> f = arrayAccess.As<v8::Function>();
...
return f->Call(info.This(), 1, argv);
 
And here we have a code, which sets indexed property handler to this function. WOW, v8 API gives us ability to add this handler!
 
DBQueryFT()->InstanceTemplate()->SetIndexedPropertyHandler(dbQueryIndexAccess);
 
... and injects it into JS cursor class, which is defined originaly in JS.
 
injectV8Function("DBQuery", DBQueryFT(), _global);
 
Tl;dr: It is hacked in C++ source code of mongo shell.