Bug 389508: Cross site XMLHttpRequest. r=jst/biesi sr/dveditz/biesi

git-svn-id: svn://10.0.0.236/trunk@231095 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/content/base/src/nsObjectLoadingContent.cpp

@@ -847,6 +847,11 @@ nsObjectLoadingContent::LoadObject(nsIURI* aURI,
   }
 
   // Security checks
+  if (doc->IsLoadedAsData()) {
+    Fallback(PR_FALSE);
+    return NS_OK;
+  }
+
   // Can't do security checks without a URI - hopefully the plugin will take
   // care of that
   // Null URIs happen when the URL to load is specified via other means than the