note that the wikitext for the saved string reads:

&#x5Dhttp://yahoo.com]

Is our regex not anchored to the start of the string somehow?

Currently, the regex looks something like this (based on wgUrlProtocols):

/^bitcoin\:|ftp\:\/\/|ftps\:\/\/|geo\:|git\:\/\/|gopher\:\/\/|http\:\/\/|https\:\/\/|irc\:\/\/|ircs\:\/\/|magnet\:|mailto\:|mms\:\/\/|news\:|nntp\:\/\/|redis\:\/\/|sftp\:\/\/|sip\:|sips\:|sms\:|ssh\:\/\/|svn\:\/\/|tel\:|telnet\:\/\/|urn\:|worldwind\:\/\/|xmpp\:|\/\//

Notice the '^' is only against 'bitcoin' and not any other protocol? Yeah I think we need to wrap everything after the '^' in brackets.

Change 139128 had a related patch set uploaded by Alex Monk:
Wrap external URL protocols regex in brackets.

https://gerrit.wikimedia.org/r/139128

Do we need to upstream a fix for wgUrlProtocols?

I don't think so. I think things including the wgUrlProtocols regex should be dealing with this issue themselves.

Change 139128 merged by jenkins-bot:
Wrap external URL protocols regex in brackets.

https://gerrit.wikimedia.org/r/139128