Since I download from time to time example files from blogs, wikis etc. I would like to know how I can avoid execution of malicious code.
Is it enough to disable the autoexec switch and see what is in the text editor?
Blender Stack Exchange is a question and answer site for people who use Blender to create 3D graphics, animations, or games. It only takes a minute to sign up.Sign up to join this community
Yes, It is enough to open a blend file with
Trusted Source disabled. *
But looking the the text editor is not the only place that can contain code. Animation driver expressions can also contain code too.
Take care, even when the file is not trusted you could inadvertently run a script by...
If you are in a situation where you need to load blend files you don't trust (an online render-farm for example). Suggest to sandbox the environment Blender runs in (see containers).
* There is the possibility of crafting a file which makes use of a buffer overrun exploit, these are much more involved then writing malicious Python scripts.
For reference, this is a known pain-point, see these threads: