--- a/modules/libpr0n/build/Makefile.in
+++ b/modules/libpr0n/build/Makefile.in
@@ -53,16 +53,19 @@ LIBXUL_LIBRARY = 1
 PACKAGE_FILE = imglib2.pkg
 
 REQUIRES	= xpcom \
 		  string \
 		  thebes \
 		  necko \
 		  nkcache \
 		  gfx \
+		  caps \
+		  xpconnect \
+		  js \
 		  $(JPEG_REQUIRES) \
 		  $(PNG_REQUIRES) \
 		  $(ZLIB_REQUIRES) \
 		  $(LCMS_REQUIRES) \
 		  $(NULL)
 
 CPPSRCS = \
 		nsImageModule.cpp \

--- a/modules/libpr0n/public/imgIRequest.idl
+++ b/modules/libpr0n/public/imgIRequest.idl
@@ -38,25 +38,26 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsISupports.idl"
 #include "nsIRequest.idl"
 
 interface imgIContainer;
 interface imgIDecoderObserver;
 interface nsIURI;
+interface nsIPrincipal;
 
 /**
  * imgIRequest interface
  *
  * @author Stuart Parmenter <stuart@mozilla.com>
  * @version 0.1
  * @see imagelib2
  */
-[scriptable, uuid(ccf705f6-1dd1-11b2-82ef-e18eccf7f7ec)]
+[scriptable, uuid(a297d3fa-5e0c-4e59-9f30-a01c9d4f3f8b)]
 interface imgIRequest : nsIRequest
 {
   /**
    * the image container...
    * @return the image object associated with the request.
    * @attention NEED DOCS
    */
   readonly attribute imgIContainer image;
@@ -75,23 +76,33 @@ interface imgIRequest : nsIRequest
   //@}
 
   /**
    * something
    * @attention NEED DOCS
    */
   readonly attribute unsigned long imageStatus;
 
+  /**
+   * The URI the image load was started with.  Note that this might not be the
+   * actual URI for the image (e.g. if HTTP redirects happened during the
+   * load).
+   */
   readonly attribute nsIURI URI;
 
   readonly attribute imgIDecoderObserver decoderObserver;
 
   readonly attribute string mimeType;
 
   /**
    * Clone this request; the returned request will have aObserver as the
    * observer.  aObserver will be notified synchronously (before the clone()
    * call returns) with all the notifications that have already been dispatched
    * for this image load.
    */
   imgIRequest clone(in imgIDecoderObserver aObserver);
+
+  /**
+   * The principal gotten from the channel the image was loaded from.
+   */
+  readonly attribute nsIPrincipal imagePrincipal;
 };
 

--- a/modules/libpr0n/src/Makefile.in
+++ b/modules/libpr0n/src/Makefile.in
@@ -51,16 +51,19 @@ LIBXUL_LIBRARY  = 1
 
 REQUIRES	= xpcom \
 		  string \
 		  necko \
 		  nkcache \
 		  gfx \
 		  thebes \
 		  cairo \
+		  caps \
+		  xpconnect \
+		  js \
 		  $(NULL)
 
 CPPSRCS		= \
 			imgCache.cpp     \
 			imgContainer.cpp \
 			imgLoader.cpp    \
 			imgRequest.cpp   \
 			imgRequestProxy.cpp

--- a/modules/libpr0n/src/imgRequest.cpp
+++ b/modules/libpr0n/src/imgRequest.cpp
@@ -56,16 +56,17 @@
 #include "nsIInputStream.h"
 #include "nsIMultiPartChannel.h"
 #include "nsIHttpChannel.h"
 
 #include "nsIComponentManager.h"
 #include "nsIProxyObjectManager.h"
 #include "nsIServiceManager.h"
 #include "nsISupportsPrimitives.h"
+#include "nsIScriptSecurityManager.h"
 
 #include "nsString.h"
 #include "nsXPIDLString.h"
 #include "plstr.h" // PL_strcasestr(...)
 
 #if defined(PR_LOGGING)
 PRLogModuleInfo *gImgLog = PR_NewLogModule("imgRequest");
 #endif
@@ -302,16 +303,27 @@ nsresult imgRequest::GetURI(nsIURI **aUR
     *aURI = mURI;
     NS_ADDREF(*aURI);
     return NS_OK;
   }
 
   return NS_ERROR_FAILURE;
 }
 
+nsresult imgRequest::GetPrincipal(nsIPrincipal **aPrincipal)
+{
+  LOG_FUNC(gImgLog, "imgRequest::GetPrincipal");
+
+  if (mPrincipal) {
+    NS_ADDREF(*aPrincipal = mPrincipal);
+  }
+
+  return NS_ERROR_FAILURE;
+}
+
 void imgRequest::RemoveFromCache()
 {
   LOG_SCOPE(gImgLog, "imgRequest::RemoveFromCache");
 
   if (mCacheEntry) {
     mCacheEntry->Doom();
     mCacheEntry = nsnull;
   }
@@ -594,17 +606,29 @@ NS_IMETHODIMP imgRequest::OnStartRequest
 
   /* notify our kids */
   nsTObserverArray<imgRequestProxy>::ForwardIterator iter(mObservers);
   imgRequestProxy* proxy;
   while ((proxy = iter.GetNext())) {
     proxy->OnStartRequest(aRequest, ctxt);
   }
 
+  /* Get our principal */
   nsCOMPtr<nsIChannel> chan(do_QueryInterface(aRequest));
+  if (chan) {
+    nsCOMPtr<nsIScriptSecurityManager> secMan =
+      do_GetService("@mozilla.org/scriptsecuritymanager;1");
+    if (secMan) {
+      nsresult rv = secMan->GetChannelPrincipal(chan,
+                                                getter_AddRefs(mPrincipal));
+      if (NS_FAILED(rv)) {
+        return rv;
+      }
+    }
+  }
 
   /* get the expires info */
   if (mCacheEntry) {
     nsCOMPtr<nsICachingChannel> cacheChannel(do_QueryInterface(aRequest));
     if (cacheChannel) {
       nsCOMPtr<nsISupports> cacheToken;
       cacheChannel->GetCacheToken(getter_AddRefs(cacheToken));
       if (cacheToken) {

--- a/modules/libpr0n/src/imgRequest.h
+++ b/modules/libpr0n/src/imgRequest.h
@@ -47,16 +47,17 @@
 #include "imgIDecoderObserver.h"
 
 #include "nsICacheEntryDescriptor.h"
 #include "nsIContentSniffer.h"
 #include "nsIRequest.h"
 #include "nsIProperties.h"
 #include "nsIStreamListener.h"
 #include "nsIURI.h"
+#include "nsIPrincipal.h"
 
 #include "nsCategoryCache.h"
 #include "nsCOMPtr.h"
 #include "nsString.h"
 #include "nsTObserverArray.h"
 #include "nsWeakReference.h"
 
 class imgCacheValidator;
@@ -116,16 +117,17 @@ private:
   inline void SetLoadId(void *aLoadId) {
     mLoadId = aLoadId;
     mLoadTime = PR_Now();
   }
   inline PRUint32 GetImageStatus() const { return mImageStatus; }
   inline nsresult GetResultFromImageStatus(PRUint32 aStatus) const;
   void Cancel(nsresult aStatus);
   nsresult GetURI(nsIURI **aURI);
+  nsresult GetPrincipal(nsIPrincipal **aPrincipal);
   void RemoveFromCache();
   inline const char *GetMimeType() const {
     return mContentType.get();
   }
   inline nsIProperties *Properties() {
     return mProperties;
   }
 
@@ -146,16 +148,17 @@ public:
   NS_DECL_IMGIDECODEROBSERVER
   NS_DECL_IMGICONTAINEROBSERVER
   NS_DECL_NSISTREAMLISTENER
   NS_DECL_NSIREQUESTOBSERVER
 
 private:
   nsCOMPtr<nsIRequest> mRequest;
   nsCOMPtr<nsIURI> mURI;
+  nsCOMPtr<nsIPrincipal> mPrincipal;
   nsCOMPtr<imgIContainer> mImage;
   nsCOMPtr<imgIDecoder> mDecoder;
   nsCOMPtr<nsIProperties> mProperties;
 
   nsTObserverArray<imgRequestProxy> mObservers;
 
   PRPackedBool mLoading;
   PRPackedBool mProcessing;

--- a/modules/libpr0n/src/imgRequestProxy.cpp
+++ b/modules/libpr0n/src/imgRequestProxy.cpp
@@ -337,16 +337,25 @@ NS_IMETHODIMP imgRequestProxy::Clone(img
   *aClone = clone;
 
   // Send the notifications to the clone's observer
   mOwner->NotifyProxyListener(clone);
 
   return NS_OK;
 }
 
+/* readonly attribute nsIPrincipal imagePrincipal; */
+NS_IMETHODIMP imgRequestProxy::GetImagePrincipal(nsIPrincipal **aPrincipal)
+{
+  if (!mOwner)
+    return NS_ERROR_FAILURE;
+
+  return mOwner->GetPrincipal(aPrincipal);
+}
+
 /** nsISupportsPriority methods **/
 
 NS_IMETHODIMP imgRequestProxy::GetPriority(PRInt32 *priority)
 {
   NS_ENSURE_STATE(mOwner);
   *priority = mOwner->Priority();
   return NS_OK;
 }