jfinal enjoy 默认已经处理了安全问题，对于绝大部分场景都很安全，通过 com.jfinal.template.expr.ast.MethodKit.java 代码可以看到下面的安全保护：

1：禁止访问的类
System.class, Runtime.class, Thread.class,
Class.class, ClassLoader.class, File.class,
Compiler.class, InheritableThreadLocal.class,
Package.class, Process.class, RuntimePermission.class,
SecurityManager.class, ThreadGroup.class, ThreadLocal.class

2：禁止访问的方法名
"getClass", "getDeclaringClass", "forName", "newInstance", "getClassLoader",
"getMethod", "getMethods", "getField", "getFields",
"notify", "notifyAll", "wait",
"load", "exit", "loadLibrary", "halt",
"stop", "suspend", "resume", "setDaemon", "setPriority"

如果你的模板中出现上述被禁止访问的类和方法名，enjoy 会自动探测到并抛出异常