Give a saner principal to documents created via DOMImplementation. Bug 324601,

r=sicking, sr=jst

content/base/src/nsDOMParser.cpp

@@ -277,7 +277,11 @@ nsDOMParser::ParseFromStream(nsIInputStream *stream,
   if (baseURI) {
     nsCOMPtr<nsIPrivateDOMImplementation> privImpl(do_QueryInterface(implementation));
     if (privImpl) {
-      privImpl->Init(baseURI);
+      // XXXbz Is this really right?  Why are we setting the documentURI to
+      // baseURI?  But note that's what the StartDocumentLoad() below would do
+      // if we let it reset.  In any case, this is odd, since the caller can
+      // set baseURI to anything it feels like, pretty much.
+      privImpl->Init(baseURI, baseURI, principal);
     }
   }
 

content/base/src/nsXMLHttpRequest.cpp

@@ -1233,7 +1233,15 @@ nsXMLHttpRequest::OnStartRequest(nsIRequest *request, nsISupports *ctxt)
   nsCOMPtr<nsIPrivateDOMImplementation> privImpl =
     do_QueryInterface(implementation);
   if (privImpl) {
-    privImpl->Init(GetBaseURI());
+    // XXXbz this is probably all wrong when not called from JS... and possibly
+    // even then! Fixing that requires giving XMLHttpRequest some principals
+    // when inited.  Until then, cases when we don't actually parse the
+    // document will give our mDocument he wrong principal.  I'm just not sure
+    // how wrong it can get...  Shouldn't be too bad as long as mScriptContext
+    // is sane, I guess.
+    nsCOMPtr<nsIDocument> doc = GetDocumentFromScriptContext(mScriptContext);
+    nsIURI* uri = GetBaseURI();
+    privImpl->Init(uri, uri, doc->GetNodePrincipal());
   }
 
   // Create an empty document from it (resets current document as well)