EDIT

The problem comes from the call of "drupal_strip_dangerous_protocols("JavaScript:popupExternalLinks('url'))" inside l(...), this call results in removing everything in front of the colon, but the "')" still at the end of the link. This additional security issue came with the drupal update (https://www.drupal.org/node/3307791).

I could remove "JavaScript:popupExternalLinks..." because it is removed anyway by the function, mentioned above. Otherwise we could add javascript to the allowed protocols or find another way to create the link without calling l().

I removed the javascript call and add the attribute to open the link in a new tab. Please review.

How can I test this? It is not yet pushed to production, or? And on test the updates are not yet installed as far as I remember. Is there an example on integration?

It works now, but it changed from using popups to opening a new tab which is maybe not wanted (there might be a reason why we were using popups). We should ask users if this is accepted behavior before closing this ticket.

The answers of the users were all that the new solution is ok or even better, so we can close this ticket.