fix: adding safeguard to prevent callable within prompt templates

[davidsbatista]

Proposed Changes:

A template with a Document or ByteStream in context could call Document.from_dict(), ByteStream.to_file(), ByteStream.from_file_path(), or Secret.resolve_value() to write/read arbitrary files or read environment variables, since these methods are defined in haystack.dataclasses/haystack.utils.auth, not on the module denylist.

Added a second check in is_safe_callable that denies any callable whose __module__ starts with haystack.dataclasses or haystack.utils.auth.

How did you test it?

Added unit tests in test/utils/test_jinja2_sandbox.py:

• attribute access on a Document still works
• Document.from_dict() → ByteStream.to_file() is blocked
• ByteStream.from_file_path() is blocked
• Secret.resolve_value() is blocked

Checklist

• I have read the contributors guidelines and the code of conduct.
• I have updated the related issue with new insights and changes.
• I have added unit tests and updated the docstrings.
• I've used one of the conventional commit types for my PR title: fix:.
• I have documented my code.
• I have added a release note file.
• I have run pre-commit hooks and fixed any issue.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
haystack-docs	Ignored	Preview	Sep 25, 2026 2:15pm UTC

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
haystack/utils
jinja2_sandbox.py
Project Total

This report was generated by python-coverage-comment-action