XSS inside a javascript

Question

Can an XSS be craft inside the following JS.

$(function () {
            $("#panel").find(".form").each(function (index) {
                var that = this;

                $(that).overload();
            });
            $("#panel").find(".form").find("[name=link]").each(function (index) {
                var that = this;

                $(that).on("click", function (event) {
                    $(that).select();
                });
            });
            $("#panel").find(".form").find("[href=#show]").each(function (index) {
                var that = this;

                $(that).on("click", function (event) {
                    prompt("HardcodedText", $(that).text());
                });
            });
        });
    </script>

The page url is something like so https://www.mylabtest.com#show I tried the following but neither worked

https://www.mylabtest.com#show]");+alert(1);//

https://www.mylabtest.com#show]");<script>alert(1);</script>

Answer 1

It would have helped if you would have provided with the HTML code as well. However, i think the reason why it does not work is because the value of the hash anchor is not being utilized in the JavaScript.

It would have been exploited as DOM based XSS if this value was being used in JavaScript somewhere. Here's is an example of code vulnerable to DOM based XSS:

URL: http://www.example.com/page.html?default=French

Select your language:
<select><script>    
document.write("<OPTION value=1>"+document.location.href.substring(document.location.href.indexOf("default=")+8)+"</OPTION>");    
document.write("<OPTION value=2>English</OPTION>");    
</script></select>