Since I download from time to time example files from blogs, wikis etc. I would like to know how I can avoid execution of malicious code.

Is it enough to disable the autoexec switch and see what is in the text editor?

  • $\begingroup$ I don't know about "enough", but AFAIK it's about the only thing you can do. $\endgroup$ – gandalf3 Jul 31 '13 at 4:52
  • 2
    $\begingroup$ The most likely thing a virus will do is change a bunch of files. You can check for this by scrolling through and making sure that don't open any files that don't make any sense (i.e. system files, config files, personal folders). Even so, they could do something else such as download malware, so it's not 100% (I prefer to just stick with the official add-ons/scripts. There are a bunch and you don't have to worry about virus's then). $\endgroup$ – CharlesL Jul 31 '13 at 11:52

Yes, It is enough to open a blend file with Trusted Source disabled. *

But looking the the text editor is not the only place that can contain code. Animation driver expressions can also contain code too.

Take care, even when the file is not trusted you could inadvertently run a script by...

  • Starting the game engine.
  • Rendering with freestyle.
  • Executing a command in the Python console.

If you are in a situation where you need to load blend files you don't trust (an online render-farm for example). Suggest to sandbox the environment Blender runs in (see containers).

* There is the possibility of crafting a file which makes use of a buffer overrun exploit, these are much more involved then writing malicious Python scripts.

For reference, this is a known pain-point, see these threads:

  • $\begingroup$ I just wonder now if we could extract all embeded files to check if the blend file is safe. I wonder if python scripts are limited (like in a sandbox) or if they can do things outside of the blend file, like in the harddrive or anything else.. And if blend file access to websites could simply be prevented... I read more things about it here $\endgroup$ – Aquarius Power Jan 6 '16 at 3:32
  • $\begingroup$ the default is set to disabled at 2.76b! to check: (info)menu: file / user preferences / file / [_] auto run python scripts $\endgroup$ – Aquarius Power Jan 6 '16 at 3:45
  • 1
    $\begingroup$ @Aquarius Power, Its not so difficult to extract embedded text, (though that deserves its own Q&A). And sand-boxing CPython isn't supported, and very difficult unless you also cripple Python at the same time making it unusable for valid use-cases too. - see: stackoverflow.com/questions/3068139/… $\endgroup$ – ideasman42 Jan 6 '16 at 6:07
  • $\begingroup$ I thought exactly on that, cripple python! its libraries to have file and internet access should require permission to be accessed! but... from the link you provided, it seems the attacker could simply create their own tiny specific lib to provide these accesses... :(, may be the best is really avoid scripts running at blender, unless we trust who created the blend file... $\endgroup$ – Aquarius Power Jan 6 '16 at 6:15
  • 2
    $\begingroup$ @Aquarius Power, this isn't really the right place to discuss security implementations, a lot of discussion on this has already taken place over the years, added links in the answer. $\endgroup$ – ideasman42 Jan 11 '16 at 4:23

Your Answer

