Normative Rules: Secure File Loading and Trust Model

← Prev | ↑ Chapter | Next → | Index | Symbols

Normative Rules: Secure File Loading and Trust Model

Statement

AutoCAD and BricsCAD restrict where executable files (.lsp, .fas, .vlx, .mnl, .scr, .arx / .crx / .dbx, .hdi, .dvb, plus host-specific items such as DLLs and .NET / VBA assemblies) may be loaded from. The restriction is governed by two system variables, SECURELOAD (how strict the gate is) and TRUSTEDPATHS (which folders are trusted), and applies to load, autoload, arxload, autoarxload, vl-vbaload, findtrustedfile, and — in clautolisp — open for a file whose extension is in the gated set above.

SECURELOAD values

Value Meaning
0 Load executable files from any location, no warning (legacy behavior).
1 Load only from trusted locations; otherwise warn (AutoCAD prompts).
2 Load only from trusted locations; non-trusted files are blocked.

clautolisp is headless — there is no interactive "trust this file?" prompt — so value 1 is interpreted as warn-and-proceed: a diagnostic is emitted ([sec-untrusted-load] / [sec-untrusted-open] on *error-output*) and the load proceeds. Value 2 blocks: the builtin sets ERRNO (73 for load) and signals a security error (:load-untrusted-file / :open-untrusted-file); the file is not loaded or opened. A trusted file is always allowed silently, at any SECURELOAD value. Under --lax the diagnostic is suppressed entirely.

The trusted set

A file is trusted when its absolute path is, in clautolisp:

  • inside a folder listed in TRUSTEDPATHS; or
  • inside one of the implicitly-trusted folders (CLAUTOLISPIMPLICITLYTRUSTEDFOLDERPATHS, clautolisp only — see its system-variable entry); or
  • an exact match of one of the user init files the engine auto-loads at startup (~/.autolisp and its XDG variants), unless --no-init was given; or
  • (under the clautolisp dialect only) inside the current working directory subtree, which that dialect prepends to the implicit folders as a convenience.

On AutoCAD and BricsCAD the trusted set is the install support tree plus whatever TRUSTEDPATHS names; the cwd is not implicitly trusted, and clautolisp matches that under --strict / --autocad / --bricscad.

TRUSTEDPATHS syntax

TRUSTEDPATHS is a semicolon-separated list of folders, each optionally quoted. A value of "" or "." adds no trusted folders beyond the implicit ones. A folder ending in \... (backslash + three dots) trusts all of its subfolders recursively. AutoCAD documents only the backslash form on Windows; AutoCAD for macOS and clautolisp also accept the forward-slash form /... (a deliberate cross-platform extension — clautolisp accepts it in every dialect and flags it only when a future autocad Windows dialect is selected; see issues/open/dialect-platform-version-axis.issue).

Per-Dialect Defaults

Dialect SECURELOAD default Settable? TRUSTEDPATHS default
:autocad-2026 1 yes host-derived ("")
:bricscad-v26 0 no (RO) "" (read-only)
:strict 1 (warn) yes ""
:lax 0 yes ""
:clautolisp 1 (warn) yes ""

--strict means the intersection of all dialects (a program that runs clean under --strict is expected to run on any implementation), not "maximally locked down": its SECURELOAD default is therefore 1 (warn), not 2. A program that needs hard blocking sets SECURELOAD to 2 itself. BricsCAD makes both sysvars read-only (admin-configured); clautolisp mirrors that under --bricscad and leaves them settable elsewhere.

Search paths

Relative names passed to load, open, and findfile are searched through the support search path: the *autolisp-support-paths* list (default the current directory), followed under the clautolisp dialect by the folders in CLAUTOLISPSUPPORTFILESEARCHPATH (default "./"). findfile searches the union of the support path and the trusted folders; findtrustedfile searches the trusted folders only. An absolute name is used directly with no search.

Environment seeding

Each trust system variable can be seeded at launch from an environment variable of the same name — SECURELOAD, TRUSTEDPATHS, CLAUTOLISPSUPPORTFILESEARCHPATH, CLAUTOLISPIMPLICITLYTRUSTEDFOLDERPATHS. Precedence is setvar > environment variable > dialect default.

Cross-references

  • Function Entry: LOAD, OPEN, FINDFILE, FINDTRUSTEDFILE (this chapter).
  • System Variable Entry: SECURELOAD, TRUSTEDPATHS, CLAUTOLISPSUPPORTFILESEARCHPATH, CLAUTOLISPIMPLICITLYTRUSTEDFOLDERPATHS (chapter 16).
  • Design spec: clautolisp/documentation/clautolisp-secureload-trust-model-spec.org (clautolisp implementation, 1.2.15–1.2.20).