When a desktop environment mounts a new medium, the medium may contain an Autostart file that can suggest to start an application or an Autoopen file that can suggest to open a specific file located on the medium.
When a new medium is mounted the root directory of the medium should be checked for the following Autostart files in order of precedence: .autorun, autorun, autorun.sh Only the first file that is present should be considered.
The desktop environment MAY ignore Autostart files altogether based on policy set by the user, system administrator or vendor.
The desktop environment MUST prompt the user for confirmation before automatically starting an application.
When an Autostart file has been detected and the user has confirmed its execution the autostart file MUST be executed with the current working directory (CWD) set to the root directory of the medium.
When a new medium is mounted and a) the medium does not contain an Autostart file or b) a policy to ignore Autostart files is in effect then the root directory of the medium should be checked for the following Autoopen files in order of precedence: .autoopen, autoopen . Only the first file that is present should be considered.
The desktop environment MAY ignore Autoopen files altogether based on policy set by the user, system administrator or vendor.
An Autoopen file MUST contain a single relative path that points to a non-executable file contained on the medium. If the file contains a newline or carriage return character then the newline or carriage return character itself and all characters that follow MUST be ignored.
The relative path MUST NOT contain path components that refer to a parent directory (../)
The relative path MUST NOT point to an executable file.
The desktop environment MUST verify that the relative path points to a file that is actually located on the medium, taking into account any symbolic or other links and MUST ignore any relative path that points to a file location outside the medium itself.
If the relative path points to an executable file then the desktop environment MUST NOT execute the file.
The desktop environment MUST prompt the user for confirmation before opening the file.
When an Autoopen file has been detected and the user has confirmed that the file indicated in the Autoopen file should be opened then the file indicated in the Autoopen file MUST be opened in the application normally preferred by the user for files of its kind UNLESS the user instructed otherwise.