This is probably specific to “javascript:” because, as @ganncamp suggested, you have something between your computer and your server which applies some kind of filter which tries to eliminate “javascript:”, e.g.:
<a href="javascript:callMyFunction()">...</a>
That seems to be confirmed by you other thread which is probably not a bug in SonarQube…