diff -u b/core/tests/Drupal/KernelTests/Component/Utility/SafeMarkupKernelTest.php b/core/tests/Drupal/KernelTests/Component/Utility/SafeMarkupKernelTest.php
--- b/core/tests/Drupal/KernelTests/Component/Utility/SafeMarkupKernelTest.php
+++ b/core/tests/Drupal/KernelTests/Component/Utility/SafeMarkupKernelTest.php
@@ -65,9 +65,12 @@
   public function providerTestSafeMarkup() {
     $data = [];
     $data['routed-url'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ['route:system.admin']], 'Hey giraffe <a href="/admin">MUUUH</a>'];
+    $data['routed-with-query'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ['route:system.admin', ['query' => ['bar' => 'baz#']]]], 'Hey giraffe <a href="/admin?bar=baz%23">MUUUH</a>'];
+    $data['routed-with-fragment'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ['route:system.admin', ['fragment' => 'bar&lt;']]], 'Hey giraffe <a href="/admin#bar&amp;lt;">MUUUH</a>'];
+    $data['unrouted-url'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ['base://foo']], 'Hey giraffe <a href="/foo">MUUUH</a>'];
     $data['unrouted-with-query'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ['base://foo', ['query' => ['bar' => 'baz#']]]], 'Hey giraffe <a href="/foo?bar=baz%23">MUUUH</a>'];
-    $data['unrouted-with-fragment'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ['base://foo', ['fragment' => 'bar&']]], 'Hey giraffe <a href="/foo#bar&amp;">MUUUH</a>'];
-    $data['mailto-protocol'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ['mailto://test@example.com']], 'Hey giraffe <a href="mailto://test@example.com">MUUUH</a>'];
+    $data['unrouted-with-fragment'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ['base://foo', ['fragment' => 'bar&lt;']]], 'Hey giraffe <a href="/foo#bar&amp;lt;">MUUUH</a>'];
+    $data['mailto-protocol'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ['mailto:test@example.com']], 'Hey giraffe <a href="mailto:test@example.com">MUUUH</a>'];
 
     return $data;
   }
@@ -87,6 +90,8 @@
     $data = [];
     $data['js-protocol'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ["javascript:alert('xss')"]]];
     $data['js-with-fromCharCode'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ["javascript:alert(String.fromCharCode(88,83,83))"]]];
+    $data['non-url-with-colon'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ["llamas: they are not URLs"]]];
+    $data['non-url-with-html'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => ['<span>not a url</span>']]];
 
     return $data;
   }
diff -u b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
--- b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
+++ b/core/tests/Drupal/Tests/Component/Utility/SafeMarkupTest.php
@@ -238,9 +238,16 @@
     $tests['external-url'] = ['Simple text <a href=":url">giraffe</a>', [':url' => 'http://example.com?foo&bar'], 'Simple text <a href="http://example.com?foo&amp;bar">giraffe</a>', 'Support for filtering bad protocols', TRUE];
     $tests['relative-url'] = ['Simple text <a href=":url">giraffe</a>', [':url' => '/node/1?foo&bar'], 'Simple text <a href="/node/1?foo&amp;bar">giraffe</a>', 'Support for filtering bad protocols', TRUE];
     $tests['fragment-with-special-chars'] = ['Simple text <a href=":url">giraffe</a>', [':url' => 'http://example.com/#&lt;'], 'Simple text <a href="http://example.com/#&amp;lt;">giraffe</a>', 'Support for filtering bad protocols', TRUE];
-    $tests['mailto-protocol'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => 'mailto://test@example.com'], 'Hey giraffe <a href="mailto://test@example.com">MUUUH</a>', '', TRUE];
+    $tests['mailto-protocol'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => 'mailto:test@example.com'], 'Hey giraffe <a href="mailto:test@example.com">MUUUH</a>', '', TRUE];
     $tests['js-with-fromCharCode'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => "javascript:alert(String.fromCharCode(88,83,83))"], 'Hey giraffe <a href="alert(String.fromCharCode(88,83,83))">MUUUH</a>', '', TRUE];
 
+    // Test some "URL" values that are not RFC 3986 compliant URLs. The result
+    // of SafeMarkup::format() should still be valid HTML (other than the
+    // value of the "href" attribute not being a valid URL), and not
+    // vulnerable to XSS.
+    $tests['non-url-with-colon'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => "llamas: they are not URLs"], 'Hey giraffe <a href=" they are not URLs">MUUUH</a>', '', TRUE];
+    $tests['non-url-with-html'] = ['Hey giraffe <a href=":url">MUUUH</a>', [':url' => "<span>not a url</span>"], 'Hey giraffe <a href="&lt;span&gt;not a url&lt;/span&gt;">MUUUH</a>', '', TRUE];
+
     return $tests;
   }