Will WCM script expose security risk?

[11年前 に qingsheng fu によって更新されました。]

assuming serviceLocator is locked from users, Are there other ways that users can use Velocity or freemarker in WCM template to explore critical services? for example gain access to all kind of LocalService bypasiing permission check? if there are, how can we prohibt that?