No, in modern browsers no XSS is possible via the
src attribute of an
So neither of these would execute the JS code in any up-to-date browser:
Analysis of your example code
location.hash always starts with a
# symbol. Since this character is illegal in JS and not a valid beginnig of a new URL, no XSS would be possible in the first place. (For instance,
eval(location.hash) always produces a syntax error.)
Let's assume, you ignore the
location.hash could really contain any string you want.
Then this security check is flawed:
An attacker could still construct a URL starting with
data: protocol? If you like to restrict the URL to absolute locations, you could whitelist the beginnings
https:// instead of blacklisting
This is fine:
Even if the
src attribute was susceptible to script code, your prefix
some/local/path/ ensures that it cannot be turned into a JS URL. However, an attacker could specify any relative path to an image file on the same server, which you might find undesirable.
NB: This is about constructing malicious
location.hash for HTML output or a different context, you have to properly sanitize the string.