Will WCM script expose security risk?

[qingsheng fu, modificado 11 Anos atrás.]

assuming serviceLocator is locked from users, Are there other ways that users can use Velocity or freemarker in WCM template to explore critical services? for example gain access to all kind of LocalService bypasiing permission check? if there are, how can we prohibt that?