diff --git a/core/lib/Drupal/Component/Utility/UrlHelper.php b/core/lib/Drupal/Component/Utility/UrlHelper.php
index 2039d83..b3da49a 100644
--- a/core/lib/Drupal/Component/Utility/UrlHelper.php
+++ b/core/lib/Drupal/Component/Utility/UrlHelper.php
@@ -271,8 +271,8 @@ public static function externalIsLocal($url, $base_url) {
   public static function filterBadProtocol($string) {
     // Get the plain text representation of the attribute value (i.e. its
     // meaning).
-    $string = Html::decodeEntities($string);
-    return SafeMarkup::checkPlain(static::stripDangerousProtocols($string));
+    $string = html_entity_decode($string, ENT_QUOTES, 'UTF-8');
+    return htmlspecialchars(static::stripDangerousProtocols($string), ENT_QUOTES, 'UTF-8');
   }
 
   /**