--- a/widget/gtk/nsDragService.cpp
+++ b/widget/gtk/nsDragService.cpp
@@ -298,29 +298,32 @@ GetGtkWindow(nsIDOMDocument *aDocument)
 }   
 
 // nsIDragService
 
 NS_IMETHODIMP
 nsDragService::InvokeDragSession(nsIDOMNode *aDOMNode,
                                  nsISupportsArray * aArrayTransferables,
                                  nsIScriptableRegion * aRegion,
-                                 uint32_t aActionType)
+                                 uint32_t aActionType,
+                                 nsContentPolicyType aContentPolicyType =
+                                   nsIContentPolicy::TYPE_OTHER)
 {
     MOZ_LOG(sDragLm, LogLevel::Debug, ("nsDragService::InvokeDragSession"));
 
     // If the previous source drag has not yet completed, signal handlers need
     // to be removed from sGrabWidget and dragend needs to be dispatched to
     // the source node, but we can't call EndDragSession yet because we don't
     // know whether or not the drag succeeded.
     if (mSourceNode)
         return NS_ERROR_NOT_AVAILABLE;
 
     return nsBaseDragService::InvokeDragSession(aDOMNode, aArrayTransferables,
-                                                aRegion, aActionType);
+                                                aRegion, aActionType,
+                                                aContentPolicyType);
 }
 
 // nsBaseDragService
 nsresult
 nsDragService::InvokeDragSessionImpl(nsISupportsArray* aArrayTransferables,
                                      nsIScriptableRegion* aRegion,
                                      uint32_t aActionType)
 {

--- a/widget/gtk/nsDragService.h
+++ b/widget/gtk/nsDragService.h
@@ -61,17 +61,18 @@ public:
     // nsBaseDragService
     virtual nsresult InvokeDragSessionImpl(nsISupportsArray* anArrayTransferables,
                                            nsIScriptableRegion* aRegion,
                                            uint32_t aActionType) override;
     // nsIDragService
     NS_IMETHOD InvokeDragSession (nsIDOMNode *aDOMNode,
                                   nsISupportsArray * anArrayTransferables,
                                   nsIScriptableRegion * aRegion,
-                                  uint32_t aActionType) override;
+                                  uint32_t aActionType,
+                                  nsContentPolicyType aContentPolicyType) override;
     NS_IMETHOD StartDragSession() override;
     NS_IMETHOD EndDragSession(bool aDoneDrag) override;
 
     // nsIDragSession
     NS_IMETHOD SetCanDrop            (bool             aCanDrop) override;
     NS_IMETHOD GetCanDrop            (bool            *aCanDrop) override;
     NS_IMETHOD GetNumDropItems       (uint32_t * aNumItems) override;
     NS_IMETHOD GetData               (nsITransferable * aTransferable,

--- a/widget/nsBaseDragService.cpp
+++ b/widget/nsBaseDragService.cpp
@@ -52,16 +52,17 @@ using namespace mozilla::image;
 #define DRAGIMAGES_PREF "nglayout.enable_drag_images"
 
 nsBaseDragService::nsBaseDragService()
   : mCanDrop(false), mOnlyChromeDrop(false), mDoingDrag(false),
     mHasImage(false), mUserCancelled(false),
     mDragEventDispatchedToChildProcess(false),
     mDragAction(DRAGDROP_ACTION_NONE),
     mDragActionFromChildProcess(DRAGDROP_ACTION_UNINITIALIZED), mTargetSize(0,0),
+    mContentPolicyType(nsIContentPolicy::TYPE_OTHER),
     mScreenX(-1), mScreenY(-1), mSuppressLevel(0),
     mInputSource(nsIDOMMouseEvent::MOZ_SOURCE_MOUSE)
 {
 }
 
 nsBaseDragService::~nsBaseDragService()
 {
 }
@@ -204,26 +205,29 @@ nsBaseDragService::SetDataTransfer(nsIDO
   return NS_OK;
 }
 
 //-------------------------------------------------------------------------
 NS_IMETHODIMP
 nsBaseDragService::InvokeDragSession(nsIDOMNode *aDOMNode,
                                      nsISupportsArray* aTransferableArray,
                                      nsIScriptableRegion* aDragRgn,
-                                     uint32_t aActionType)
+                                     uint32_t aActionType,
+                                     nsContentPolicyType aContentPolicyType =
+                                       nsIContentPolicy::TYPE_OTHER)
 {
   PROFILER_LABEL_FUNC(js::ProfileEntry::Category::OTHER);
 
   NS_ENSURE_TRUE(aDOMNode, NS_ERROR_INVALID_ARG);
   NS_ENSURE_TRUE(mSuppressLevel == 0, NS_ERROR_FAILURE);
 
   // stash the document of the dom node
   aDOMNode->GetOwnerDocument(getter_AddRefs(mSourceDocument));
   mSourceNode = aDOMNode;
+  mContentPolicyType = aContentPolicyType;
   mEndDragPoint = LayoutDeviceIntPoint(0, 0);
 
   // When the mouse goes down, the selection code starts a mouse
   // capture. However, this gets in the way of determining drag
   // feedback for things like trees because the event coordinates
   // are in the wrong coord system, so turn off mouse capture.
   nsIPresShell::ClearMouseCapture(nullptr);
 
@@ -259,17 +263,18 @@ nsBaseDragService::InvokeDragSessionWith
   mImage = aImage;
   mImageOffset = CSSIntPoint(aImageX, aImageY);
 
   aDragEvent->GetScreenX(&mScreenX);
   aDragEvent->GetScreenY(&mScreenY);
   aDragEvent->GetMozInputSource(&mInputSource);
 
   nsresult rv = InvokeDragSession(aDOMNode, aTransferableArray,
-                                  aRegion, aActionType);
+                                  aRegion, aActionType,
+                                  nsIContentPolicy::TYPE_INTERNAL_IMAGE);
 
   if (NS_FAILED(rv)) {
     mImage = nullptr;
     mHasImage = false;
     mDataTransfer = nullptr;
   }
 
   return rv;
@@ -299,17 +304,18 @@ nsBaseDragService::InvokeDragSessionWith
 
   // just get the focused node from the selection
   // XXXndeakin this should actually be the deepest node that contains both
   // endpoints of the selection
   nsCOMPtr<nsIDOMNode> node;
   aSelection->GetFocusNode(getter_AddRefs(node));
 
   nsresult rv = InvokeDragSession(node, aTransferableArray,
-                                  nullptr, aActionType);
+                                  nullptr, aActionType,
+                                  nsIContentPolicy::TYPE_OTHER);
 
   if (NS_FAILED(rv)) {
     mHasImage = false;
     mSelection = nullptr;
     mDataTransfer = nullptr;
   }
 
   return rv;

--- a/widget/nsBaseDragService.h
+++ b/widget/nsBaseDragService.h
@@ -151,16 +151,18 @@ protected:
 
   uint32_t mDragAction;
   uint32_t mDragActionFromChildProcess;
 
   nsSize mTargetSize;
   nsCOMPtr<nsIDOMNode> mSourceNode;
   nsCOMPtr<nsIDOMDocument> mSourceDocument;       // the document at the drag source. will be null
                                                   //  if it came from outside the app.
+  nsContentPolicyType mContentPolicyType;         // the contentpolicy type passed to the channel
+                                                  // when initiating the drag session
   nsCOMPtr<nsIDOMDataTransfer> mDataTransfer;
 
   // used to determine the image to appear on the cursor while dragging
   nsCOMPtr<nsIDOMNode> mImage;
   // offset of cursor within the image
   mozilla::CSSIntPoint mImageOffset;
 
   // set if a selection is being dragged

--- a/widget/nsIDragService.idl
+++ b/widget/nsIDragService.idl
@@ -3,17 +3,17 @@
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsISupports.idl"
 #include "nsISupportsArray.idl"
 #include "nsIDragSession.idl"
 #include "nsIScriptableRegion.idl"
-
+#include "nsIContentPolicyBase.idl"
 
 interface nsIDOMNode;
 interface nsIDOMDragEvent;
 interface nsIDOMDataTransfer;
 interface nsISelection;
 
 %{C++
 #include "mozilla/EventForwards.h"
@@ -39,19 +39,25 @@ interface nsIDragService : nsISupports
 
   /**
     * Starts a modal drag session with an array of transaferables 
     *
     * @param  aTransferables - an array of transferables to be dragged
     * @param  aRegion - a region containing rectangles for cursor feedback, 
     *            in window coordinates.
     * @param  aActionType - specified which of copy/move/link are allowed
+    * @param  aContentPolicyType - the contentPolicyType that will be
+    *           passed to the loadInfo when creating a new channel
+    *           (defaults to TYPE_OTHER)
     */
-  void invokeDragSession ( in nsIDOMNode aDOMNode, in nsISupportsArray aTransferables, 
-                             in nsIScriptableRegion aRegion, in unsigned long aActionType );
+  void invokeDragSession (in nsIDOMNode aDOMNode,
+                          in nsISupportsArray aTransferables, 
+                          in nsIScriptableRegion aRegion,
+                          in unsigned long aActionType,
+                          [optional] in nsContentPolicyType aContentPolicyType);
 
   /**
    * Starts a modal drag session using an image. The first four arguments are
    * the same as invokeDragSession.
    *
    * A custom image may be specified using the aImage argument. If this is
    * supplied, the aImageX and aImageY arguments specify the offset within
    * the image where the cursor would be positioned. That is, when the image

--- a/widget/nsITransferable.idl
+++ b/widget/nsITransferable.idl
@@ -2,16 +2,17 @@
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsISupports.idl"
 #include "nsISupportsArray.idl"
 #include "nsIFormatConverter.idl"
+#include "nsIContentPolicyBase.idl"
 
 interface nsIDOMNode;
 
 %{ C++
 
 // these probably shouldn't live here, but in some central repository shared
 // by the entire app.
 #define kTextMime                   "text/plain"
@@ -194,16 +195,18 @@ interface nsITransferable : nsISupports
   /**
    * Use of the SetIsPrivateData() method generated by isPrivateData attribute should 
    * be avoided as much as possible because the value set may not reflect the status 
    * of the context in which the transferable was created.
    */
   [noscript] attribute boolean isPrivateData;
 
   /**
-   * The source dom node this transferable was created from.
-   * Note, currently only in use on Windows for network principal
-   * information in drag operations.
+   * The source dom node this transferable was created from and
+   * the contentPolicyType for the transferable.
+   * Note, currently only used on Windows for network principal and
+   * contentPolicyType information in drag operations.
    */
   [noscript] attribute nsIDOMNode requestingNode;
+  [noscript] attribute nsContentPolicyType contentPolicyType;
 
 };
 

--- a/widget/nsTransferable.cpp
+++ b/widget/nsTransferable.cpp
@@ -13,16 +13,17 @@ Notes to self:
 */
 
  
 #include "nsTransferable.h"
 #include "nsString.h"
 #include "nsReadableUtils.h"
 #include "nsTArray.h"
 #include "nsIFormatConverter.h"
+#include "nsIContentPolicy.h"
 #include "nsIComponentManager.h"
 #include "nsCOMPtr.h"
 #include "nsXPCOM.h"
 #include "nsISupportsPrimitives.h"
 #include "nsMemory.h"
 #include "nsPrimitiveHelpers.h"
 #include "nsXPIDLString.h"
 #include "nsDirectoryServiceDefs.h"
@@ -213,16 +214,17 @@ DataStruct::ReadCache(nsISupports** aDat
 
 //-------------------------------------------------------------------------
 //
 // Transferable constructor
 //
 //-------------------------------------------------------------------------
 nsTransferable::nsTransferable()
   : mPrivateData(false)
+  , mContentPolicyType(nsIContentPolicy::TYPE_OTHER)
 #ifdef DEBUG
   , mInitialized(false)
 #endif
 {
 }
 
 //-------------------------------------------------------------------------
 //
@@ -638,8 +640,23 @@ nsTransferable::GetRequestingNode(nsIDOM
 }
 
 NS_IMETHODIMP
 nsTransferable::SetRequestingNode(nsIDOMNode* aRequestingNode)
 {
   mRequestingNode = do_GetWeakReference(aRequestingNode);
   return NS_OK;
 }
+
+NS_IMETHODIMP
+nsTransferable::GetContentPolicyType(nsContentPolicyType* outContentPolicyType)
+{
+  NS_ENSURE_ARG_POINTER(outContentPolicyType);
+  *outContentPolicyType = mContentPolicyType;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsTransferable::SetContentPolicyType(nsContentPolicyType aContentPolicyType)
+{
+  mContentPolicyType = aContentPolicyType;
+  return NS_OK;
+}

--- a/widget/nsTransferable.h
+++ b/widget/nsTransferable.h
@@ -1,16 +1,17 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef nsTransferable_h__
 #define nsTransferable_h__
 
+#include "nsIContentPolicyBase.h"
 #include "nsIFormatConverter.h"
 #include "nsITransferable.h"
 #include "nsCOMPtr.h"
 #include "nsString.h"
 #include "nsTArray.h"
 #include "nsWeakPtr.h"
 
 class nsString;
@@ -69,15 +70,16 @@ protected:
 
     // get flavors w/out converter
   nsresult GetTransferDataFlavors(nsISupportsArray** aDataFlavorList);
  
   nsTArray<DataStruct> mDataArray;
   nsCOMPtr<nsIFormatConverter> mFormatConv;
   bool mPrivateData;
   nsWeakPtr mRequestingNode;
+  nsContentPolicyType mContentPolicyType;
 #if DEBUG
   bool mInitialized;
 #endif
 
 };
 
 #endif // nsTransferable_h__

--- a/widget/windows/nsDataObj.cpp
+++ b/widget/windows/nsDataObj.cpp
@@ -59,34 +59,35 @@ nsDataObj::CStream::CStream() :
 //-----------------------------------------------------------------------------
 nsDataObj::CStream::~CStream()
 {
 }
 
 //-----------------------------------------------------------------------------
 // helper - initializes the stream
 nsresult nsDataObj::CStream::Init(nsIURI *pSourceURI,
+                                  uint32_t aContentPolicyType,
                                   nsINode* aRequestingNode)
 {
   // we can not create a channel without a requestingNode
   if (!aRequestingNode) {
     return NS_ERROR_FAILURE;
   }
   nsresult rv;
   rv = NS_NewChannel(getter_AddRefs(mChannel),
                      pSourceURI,
                      aRequestingNode,
-                     nsILoadInfo::SEC_NORMAL,
-                     nsIContentPolicy::TYPE_OTHER,
+                     nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS,
+                     aContentPolicyType,
                      nullptr,   // loadGroup
                      nullptr,   // aCallbacks
                      nsIRequest::LOAD_FROM_CACHE);
 
   NS_ENSURE_SUCCESS(rv, rv);
-  rv = mChannel->AsyncOpen(this, nullptr);
+  rv = mChannel->AsyncOpen2(this);
   NS_ENSURE_SUCCESS(rv, rv);
   return NS_OK;
 }
 
 //-----------------------------------------------------------------------------
 // IUnknown's QueryInterface, nsISupport's AddRef and Release are shared by
 // IUnknown and nsIStreamListener.
 STDMETHODIMP nsDataObj::CStream::QueryInterface(REFIID refiid, void** ppvResult)
@@ -340,18 +341,20 @@ HRESULT nsDataObj::CreateStream(IStream 
 
   pStream->AddRef();
 
   // query the requestingNode from the transferable and add it to the new channel
   nsCOMPtr<nsIDOMNode> requestingDomNode;
   mTransferable->GetRequestingNode(getter_AddRefs(requestingDomNode));
   nsCOMPtr<nsINode> requestingNode = do_QueryInterface(requestingDomNode);
   MOZ_ASSERT(requestingNode, "can not create channel without a node");
-
-  rv = pStream->Init(sourceURI, requestingNode);
+  // default transferable content policy is nsIContentPolicy::TYPE_OTHER
+  uint32_t contentPolicyType = nsIContentPolicy::TYPE_OTHER;
+  mTransferable->GetContentPolicyType(&contentPolicyType);
+  rv = pStream->Init(sourceURI, contentPolicyType, requestingNode);
   if (NS_FAILED(rv))
   {
     pStream->Release();
     return E_FAIL;
   }
   *outStream = pStream;
 
   return S_OK;

--- a/widget/windows/nsDataObj.h
+++ b/widget/windows/nsDataObj.h
@@ -244,17 +244,19 @@ protected:
       uint32_t mStreamRead;
 
     protected:
       virtual ~CStream();
       nsresult WaitForCompletion();
 
     public:
       CStream();
-      nsresult Init(nsIURI *pSourceURI, nsINode* aRequestingNode);
+      nsresult Init(nsIURI *pSourceURI,
+                    uint32_t aContentPolicyType,
+                    nsINode* aRequestingNode);
 
       NS_DECL_ISUPPORTS
       NS_DECL_NSIREQUESTOBSERVER
       NS_DECL_NSISTREAMLISTENER
 
       // IUnknown
       STDMETHOD(QueryInterface)(REFIID refiid, void** ppvResult);
 

--- a/widget/windows/nsDragService.cpp
+++ b/widget/windows/nsDragService.cpp
@@ -202,16 +202,17 @@ nsDragService::InvokeDragSessionImpl(nsI
     itemToDrag = dataObjCollection;
     for (uint32_t i=0; i<numItemsToDrag; ++i) {
       nsCOMPtr<nsISupports> supports;
       anArrayTransferables->GetElementAt(i, getter_AddRefs(supports));
       nsCOMPtr<nsITransferable> trans(do_QueryInterface(supports));
       if (trans) {
         // set the requestingNode on the transferable
         trans->SetRequestingNode(mSourceNode);
+        trans->SetContentPolicyType(mContentPolicyType);
         RefPtr<IDataObject> dataObj;
         rv = nsClipboard::CreateNativeDataObject(trans,
                                                  getter_AddRefs(dataObj), uri);
         NS_ENSURE_SUCCESS(rv, rv);
         // Add the flavors to the collection object too
         rv = nsClipboard::SetupNativeDataObject(trans, dataObjCollection);
         NS_ENSURE_SUCCESS(rv, rv);
 
@@ -221,16 +222,17 @@ nsDragService::InvokeDragSessionImpl(nsI
   } // if dragging multiple items
   else {
     nsCOMPtr<nsISupports> supports;
     anArrayTransferables->GetElementAt(0, getter_AddRefs(supports));
     nsCOMPtr<nsITransferable> trans(do_QueryInterface(supports));
     if (trans) {
       // set the requestingNode on the transferable
       trans->SetRequestingNode(mSourceNode);
+      trans->SetContentPolicyType(mContentPolicyType);
       rv = nsClipboard::CreateNativeDataObject(trans,
                                                getter_AddRefs(itemToDrag),
                                                uri);
       NS_ENSURE_SUCCESS(rv, rv);
     }
   } // else dragging a single object
 
   // Create a drag image if support is available