IPP
mash.ipp · Platform
Methods
Section titled “Methods”ipp.job(uri: string, jobId: int, user?: string = "", password?: string = "", curlOptions?: array = [])mash.ipp.job(uri, jobId, …) — a job on a printer, for its job operations (getJobAttributes, cancelJob, hold, release…). Each sends an IPP request to the job’s printer, so the URI is guarded like printer(). Building obray\IPP\Job through the package skipped that: a script sent a request to any host, loopback and the cluster network included, with its own curl options. Found 2026-10-03.
printer
Section titled “printer”ipp.printer(uri: string, user?: string = "", password?: string = "", curlOptions?: array = [])mash.ipp.printer(uri, …) — a real method, not a package lookup, so the printer URI is guarded (SSRF) and script curl options are refused. Before this a script named any host and set any curl option verbatim (a raw connection to a script-chosen destination, loopback and the cluster network included — and CURLOPT_PROXY / CURLOPT_UNIX_SOCKET_PATH and the like). The printer’s URL now goes through the run’s SecurityProvider, the same guard mash.http uses, so an appliance administrator’s whitelist (or the switch that turns the guard off) applies to it too. Found 2026-09-30.