Google Gears Installation website is vulnerable to content insertion via url parameter:

gears.google.com/?action=insta ... your funny message here

here's one example,
gears.google.com/?action=insta ...!

Here's another fun one that breaks the scientology copyrights (it's text from the new era dianetics for operating thetans):

gears.google.com/?action=insta ...

Great find!

Cool! can we insert javascript DOM element

Try this

gears.google.com/?action=insta ...

var regex = new RegExp('[\?&]' + name + '=([^&#]*)');
var results = regex.exec(window.location.href);
return results && decodeURIComponent(results[1]);

Neat! gears.google.com/?action=insta ...

blogoscoped.com/files/google-g ...

Suresh, HTML seems to be filtered, no?

<font size="-1">
   <p><span id="app_message"></span></p>

i tried to insert javascript , HTML tag it doesnt render as html tag.

function putParamText(nodeId, paramName) {
var text = getQueryParam(paramName);
   if (text) {
   if (text.length > 150) {
   text = text.substring(0, 150)
   }
   var node = document.getElementById(nodeId);
   if (node) {
   node.innerText = node.textContent = text;
   }
}
}
putParamText('app_message','message');

innerText ? instead of innerHTML

I wonder if the number of indexed urls (5) will go up soon?

google.com/search?q=site:gears ...

code.google.com/apis/gears/des ...

"Use the URL in the code above to access the Google Gears installation page. Substitute your customized message and your URL in the parameters."

"message: Provide any text up to 150 characters. This message appears at the top of the installation page. For example: "Install Google Gears to enable MyGreatApp's offline features!""

yes i have seen that already. the question was why HTML was not rendered.

<< Provide any TEXT up to 150 characters. This message appears at the top of the installation page. >>

I hope googlebot will index it. It would be fun.

> the question was why HTML was not rendered.

Rendering HTML could compromise the page (HTML injection – Google has a whitelist of tags with which thea clean HTML, but this might still allow you to leave e.g. <b> tag open, rendering the whole page in bold). And rendering JS would even compromise the Google cookie.

> I hope googlebot will index it.

Hmm... I can't see any meta-directive excluding robots in the page itself, and as there's no robots.txt file at this time (gears.google.com/robots.txt)... I guess it can be indexed, as it's linked from other places (like this forum). This search doesn't yet return results though:
google.com/search?hl=en&q= ...