href javascript: generated by visual force page not working in firefox and IE

First: I know you should not use href javascript: to put javascript o a link. It is bad practise and all I can find on the forums is don't use it and questions regarding this are rejected. But I am not generating the html. It is salesforce who is generating html and I suppose they don't know better.

Now this is not working in Firefox and IE. Only in chrome. The strange thing is that if I try to write the same href in a test html page all 3 browsers seem to happily execute the javascript following the javascript: so it is not that is not supported by all browsers.

However with the visual force page embedded in the lightning interface such links no longer work. So I was wondering if there is anything I could investigate or do to get these working so any general information about why such links would not work or more specific why salesforce would be doing this for VF pages in the lightning interface could help me.

Such links are generated with the

        <apex:outputLink target="_top" value="{!UpdateLink}">/apex:outputLink>

and to check that such links do not work when embedded in the lightning page I inserted the following snippet of html both in my VF page and in a blank html page

    <script type="text/javascript">
        function DebugClick ()
        {
            alert ('click');
            return false;
        }

    </script>

    <a href="javascript:DebugClick ();" target="_top">debugger</a>

In the html page it works in all three browsers. In the VF page it only works in chrome.

I also forced a break in the code and inspected the code using javascript to see if either the href attribute or the onclick of the link were changed but they seem intact. Here is my console output copy where I inspected the actual link not working, not my test link

  window.getElementByIdCS('j_id0:j_id1:j_id2:updatelinkpnl').childNodes [0].onclick
     null
  window.getElementByIdCS('j_id0:j_id1:j_id2:updatelinkpnl').childNodes [0].attributes ['href']
     href="javascript:srcUp('https%3A%2F%2Fbvdep.na5.visual.force.com%2Fapex%2FBvDAccountLink%3Faction%3DUpdate%26id%3D0017000001THUbxAAH%26objType%3DAccount%26product%3Dorbisneo%26isdtp%3Dp1');"

Solution

I finally cracked it (and see more or less where it is coming from) so here is for anyone encountering a similar issue what seem to be the key factors. The is in an iframe. And the target is _top. I know this is a strange combinbination, but the original url was a simple link that needed the top target. It is only the lightning interface that substituted this to use javascript but doesn't remove the top. Apparently IE and firefox then refuse to execute it. It might be that some security policy headers are part of the equation, but since I found a solution (make the target=_top dependant on the inteface I had no need to search further