diff --git a/mozilla/content/html/document/src/nsHTMLContentSink.cpp b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
index d7730a41798..72cac7924a5 100644
--- a/mozilla/content/html/document/src/nsHTMLContentSink.cpp
+++ b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
@@ -3663,7 +3663,7 @@ HTMLContentSink::ProcessMETATag(const nsIParserNode& aNode)
                   // go past the '=' sign
                   loc = result.Find("=", PR_TRUE, loc);
                   if (loc > -1) {
-                      loc++; // leading/trailign spaces get trimmed in url creating code.
+                      loc++; // leading/trailing spaces get trimmed in url creating code.
                       result.Mid(uriAttribStr, loc, result.Length() - loc);
                       uriCStr = uriAttribStr.GetUnicode();
                   }
@@ -3671,6 +3671,12 @@ HTMLContentSink::ProcessMETATag(const nsIParserNode& aNode)
 
               nsIURI *uri = nsnull;
               rv = NS_NewURI(&uri, uriCStr, baseURI);
+              if (loc > -1 && NS_SUCCEEDED(rv)) {
+                  NS_WITH_SERVICE(nsIScriptSecurityManager, securityManager, 
+                                  NS_SCRIPTSECURITYMANAGER_PROGID, &rv);
+                  if (NS_SUCCEEDED(rv))
+                      rv = securityManager->CheckLoadURI(baseURI, uri);
+              }
               NS_RELEASE(baseURI);
               if (NS_FAILED(rv)) return rv;
 
diff --git a/mozilla/layout/html/document/src/nsHTMLContentSink.cpp b/mozilla/layout/html/document/src/nsHTMLContentSink.cpp
index d7730a41798..72cac7924a5 100644
--- a/mozilla/layout/html/document/src/nsHTMLContentSink.cpp
+++ b/mozilla/layout/html/document/src/nsHTMLContentSink.cpp
@@ -3663,7 +3663,7 @@ HTMLContentSink::ProcessMETATag(const nsIParserNode& aNode)
                   // go past the '=' sign
                   loc = result.Find("=", PR_TRUE, loc);
                   if (loc > -1) {
-                      loc++; // leading/trailign spaces get trimmed in url creating code.
+                      loc++; // leading/trailing spaces get trimmed in url creating code.
                       result.Mid(uriAttribStr, loc, result.Length() - loc);
                       uriCStr = uriAttribStr.GetUnicode();
                   }
@@ -3671,6 +3671,12 @@ HTMLContentSink::ProcessMETATag(const nsIParserNode& aNode)
 
               nsIURI *uri = nsnull;
               rv = NS_NewURI(&uri, uriCStr, baseURI);
+              if (loc > -1 && NS_SUCCEEDED(rv)) {
+                  NS_WITH_SERVICE(nsIScriptSecurityManager, securityManager, 
+                                  NS_SCRIPTSECURITYMANAGER_PROGID, &rv);
+                  if (NS_SUCCEEDED(rv))
+                      rv = securityManager->CheckLoadURI(baseURI, uri);
+              }
               NS_RELEASE(baseURI);
               if (NS_FAILED(rv)) return rv;
 
diff --git a/mozilla/netwerk/protocol/http/src/nsHTTPChannel.cpp b/mozilla/netwerk/protocol/http/src/nsHTTPChannel.cpp
index 9b24880689c..4b118e2fa0f 100644
--- a/mozilla/netwerk/protocol/http/src/nsHTTPChannel.cpp
+++ b/mozilla/netwerk/protocol/http/src/nsHTTPChannel.cpp
@@ -49,6 +49,7 @@
 #include "nsAuthEngine.h"
 #include "nsINetDataCacheManager.h"
 #include "nsINetDataCache.h"
+#include "nsIScriptSecurityManager.h"
 
 #ifdef DEBUG_gagan
 #include "nsUnixColorPrintf.h"
@@ -1255,6 +1256,12 @@ nsresult nsHTTPChannel::Redirect(const char *aNewLocation,
   nsAllocator::Free(newURLSpec);
 #endif /* PR_LOGGING */
 
+  NS_WITH_SERVICE(nsIScriptSecurityManager, securityManager, 
+                  NS_SCRIPTSECURITYMANAGER_PROGID, &rv);
+  if (NS_FAILED(rv)) return rv;
+  rv = securityManager->CheckLoadURI(mOriginalURI, newURI);
+  if (NS_FAILED(rv)) return rv;
+
   rv = serv->NewChannelFromURI(mVerb.GetBuffer(), newURI, mLoadGroup, mCallbacks,
                                mLoadAttributes, mOriginalURI, 
                                mBufferSegmentSize, mBufferMaxSize, getter_AddRefs(channel));