Non-http links in issue descriptions are clickable in preview mode, but become plain-text when saved

Summary

Links with protocols other than HTTP(s) such as file://, smb:// or nfs:// become non-clickable text once an issue is saved. While using the preview of the issue description or in an issue comment, though, the links still work properly.

This is inconsistency prevents the customer from using valid links to internal services in issues.

Reported by a Premium customer (internal ticket), but I reproduced on GitLab.com.

Steps to reproduce

  1. Start creating a new issue and add a valid file://, smb://, nfs:// etc. URL to its description.
  2. Switch to Preview & test the link
  3. Create the issue and test the link again
  4. Test the same link in an issue comment: while preview-ing and after saving the comment

Example Project

What is the current bug behavior?

The URL isn't rendered as a hyperlink after saving.

What is the expected correct behavior?

The rendering is consistent between preview and final mode, as well as between issue description and comments.

Looking at https://docs.gitlab.com/ee/development/shell_commands.html#properly-anchor-regular-expressions-to-the-start-and-end-of-strings this seems security relevant, thus I'm starting this as a confidential issue.

Relevant logs and/or screenshots

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info 
(For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check 
(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)


(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)


(we will only investigate if the tests are passing)

Possible fixes

Edited by Katrin Leinweber