fix security on evaluation of template