rem: nsIScriptSecMan.DISALLOW_SCRIPT_OR_DATA); 
add: nsIScriptSecMan.DISALLOW_INHERIT_PRINCIPAL); 
context:   onDrop: function (aEvent, aXferData, aDragSession)    {      var url = transferUtils.retrieveURLFromData(aXferData.data, aXferData.flavour.contentType);      // The URL bar automatically handles inputs with newline characters,      // so we can get away with treating text/x-moz-url flavours as text/unicode.      if (url) {        getBrowser().dragDropSecurityCheck(aEvent, aDragSession, url);        try {          gURLBar.value = url;          const nsIScriptSecMan = Components.interfaces.nsIScriptSecurityManager;          urlSecurityCheck(gURLBar.value, gBrowser.currentURI.spec,                           nsIScriptSecMan.DISALLOW_SCRIPT_OR_DATA);          handleURLBarCommand();        } catch (ex) {}      }    },
meta: 5872	/local1/tlutelli/issta_data/temp/all_js/javascript/2006_temp/2006/5872/0a3a6241492676d80676502466689d527d7fd1cf/browser.js/clean/browser/base/content/browser.js