[stringify/url] only own properties can be locals

src/kibana/components/stringify/types/Url.js

@@ -83,8 +83,10 @@ define(function (require) {
         var i = -1;
         while (++i < parts.length) {
           if (i % 2) {
-            var local = locals[parts[i]];
-            output += local == null ? '' : local;
+            if (locals.hasOwnProperty(parts[i])) {
+              var local = locals[parts[i]];
+              output += local == null ? '' : local;
+            }
           } else {
             output += parts[i];
           }

test/unit/specs/components/stringify/index.js

@@ -183,6 +183,17 @@ define(function (require) {
           expect(url.convert('url', 'text')).to.be('');
         });
 
+        it('does not get values from the prototype chain', function () {
+          Object.prototype.cantStopMeNow = {
+            toString: function () {
+              return 'fail';
+            }
+          };
+
+          var url = new Url({ template: '{{ cantStopMeNow }}' });
+          expect(url.convert('url', 'text')).to.be('');
+        });
+
       });
     });