Google Blogoscoped

Forum

Google Gears Installation Website Vulnerable To Content Insertion

John Quntaero [PersonRank 1]

Thursday, June 7, 2007
17 years ago4,304 views

Google Gears Installation website is vulnerable to content insertion via url parameter:

http://gears.google.com/?action=install&message=<insert your funny message here

here's one example,
http://gears.google.com/?action=install&message=Google%20was%20actually%20created%20by%20aliens%20who%20came%20to%20our%20solar%20system%20thousands%20of%20decades%20ago.%20Aqua%20Teen%20Hunger%20Force%20Colon%20Movie%20Film%20for%20Theaters%20totally%20rawks%20you!

Here's another fun one that breaks the scientology copyrights (it's text from the new era dianetics for operating thetans):

http://gears.google.com/?action=install&message=As%20has%20been%20announced,%20there%20is%20a%20special%20handling%20for%20OTs%20who%20have%20been%20run%20on%20Dianetics%20since%20Clear.%20It%20is%20called%20%22NED%20for%20OTs%22.

Ken Wong [PersonRank 5]

17 years ago #

Great find!

Suresh S [PersonRank 10]

17 years ago #

Cool! can we insert javascript DOM element

Suresh S [PersonRank 10]

17 years ago #

Try this

http://gears.google.com/?action=install&message=\

var regex = new RegExp('[\?&]' + name + '=([^&#]*)');
var results = regex.exec(window.location.href);
return results && decodeURIComponent(results[1]);

Philipp Lenssen [PersonRank 10]

17 years ago #

Neat! http://gears.google.com/?action=install&message=Google%20supports%20the%20fight%20against%20DRM%2C%20and%20we%20hereby%20reprint%20the%20following%3A%2009%20F9%2011%2002%209D%2074%20E3%205B%20D8%2041%2056%20C5%2063%2056%2088%20C0

http://blogoscoped.com/files/google-gears-content-insertion.png

> var regex = new RegEx...

Suresh, HTML seems to be filtered, no?

Suresh S [PersonRank 10]

17 years ago #

Suresh, HTML seems to be filtered, no?

<font size="-1">
   <p><span id="app_message"></span></p>

i tried to insert javascript , HTML tag it doesnt render as html tag.

function putParamText(nodeId, paramName) {
var text = getQueryParam(paramName);
   if (text) {
   if (text.length > 150) {
   text = text.substring(0, 150)
   }
   var node = document.getElementById(nodeId);
   if (node) {
   node.innerText = node.textContent = text;
   }
}
}
putParamText('app_message','message');

innerText ? instead of innerHTML

John Quntaero [PersonRank 1]

17 years ago #

I wonder if the number of indexed urls (5) will go up soon?

http://www.google.com/search?q=site:gears.google.com&filter=0

Anonymous [PersonRank 0]

17 years ago #

http://code.google.com/apis/gears/design.html

"Use the URL in the code above to access the Google Gears installation page. Substitute your customized message and your URL in the parameters."

"message: Provide any text up to 150 characters. This message appears at the top of the installation page. For example: "Install Google Gears to enable MyGreatApp's offline features!""

Suresh S [PersonRank 10]

17 years ago #

yes i have seen that already. the question was why HTML was not rendered.

Ionut Alex. Chitu [PersonRank 10]

17 years ago #

<< Provide any TEXT up to 150 characters. This message appears at the top of the installation page. >>

TOMHTML [PersonRank 10]

17 years ago #

I hope googlebot will index it. It would be fun.

Philipp Lenssen [PersonRank 10]

17 years ago #

> the question was why HTML was not rendered.

Rendering HTML could compromise the page (HTML injection – Google has a whitelist of tags with which thea clean HTML, but this might still allow you to leave e.g. <b> tag open, rendering the whole page in bold). And rendering JS would even compromise the Google cookie.

> I hope googlebot will index it.

Hmm... I can't see any meta-directive excluding robots in the page itself, and as there's no robots.txt file at this time (http://gears.google.com/robots.txt)... I guess it can be indexed, as it's linked from other places (like this forum). This search doesn't yet return results though:
http://www.google.com/search?hl=en&q=%22Google+was+actually+created+by+aliens+who+came+to+our+solar+system%22&btnG=Google+Search

Forum home

Advertisement

 
Blog  |  Forum     more >> Archive | Feed | Google's blogs | About
Advertisement

 

This site unofficially covers Google™ and more with some rights reserved. Join our forum!