l() now strips dangerous protocols from the $path

The l() function now strips dangerous protocols from the $path variable using drupal_strip_dangerous_protocols().

If you are using the l() function to output links with other than allowed protocols (see variable_get('filter_allowed_protocols')) then the output link will be no longer working as expected. In this case you can either update the filter_allowed_protocols variable to whitelist the stripped protocol (however we do not recommend this for specific protocols like javascript:), or replace the usage of the l() function with different logic to output the desired link.

Before:

// Prints a link which will trigger alert once clicked: <a href="javascript:alert('XSS')">link</a>
print l('link', "javascript:alert('XSS')", array('external' => TRUE)); 

After:

// Prints a non-functional link: <a href="alert('XSS')">link</a>
print l('link', "javascript:alert('XSS')", array('external' => TRUE));