fix the security hole from service framework itself

Couldn't find any testcases around will be happy to add them if needed.