Will WCM script expose security risk?

[qingsheng fu, módosítva 11 év-val korábban]

assuming serviceLocator is locked from users, Are there other ways that users can use Velocity or freemarker in WCM template to explore critical services? for example gain access to all kind of LocalService bypasiing permission check? if there are, how can we prohibt that?