Recover from all `URI::Error`s

Fixes #2257
Fixes #2260

app/helpers/application_helper.rb

@@ -255,12 +255,16 @@ module ApplicationHelper
   #
   # Returns `html_options`, adding `rel: nofollow` for external links
   def add_nofollow(link, html_options = {})
+    begin
       uri = URI(link)
 
       if uri && uri.absolute? && uri.host != Gitlab.config.gitlab.host
         rel = html_options.fetch(:rel, '')
         html_options[:rel] = (rel + ' nofollow').strip
       end
+    rescue URI::Error
+      # noop
+    end
 
     html_options
   end

spec/helpers/application_helper_spec.rb

@@ -249,6 +249,16 @@ describe ApplicationHelper do
       expect(link_to('Example', 'http://example.foo/bar')).
         to eq '<a href="http://example.foo/bar">Example</a>'
     end
+
+    it 'should not raise an error when given a bad URI' do
+      expect { link_to('default', 'if real=1 RANDOM; if real>1 IDLHS; if real>500 LHS') }.
+        not_to raise_error
+    end
+
+    it 'should not raise an error when given a bad mailto URL' do
+      expect { link_to('email', 'mailto://foo.bar@example.es?subject=Subject%20Line') }.
+        not_to raise_error
+    end
   end
 
   describe 'markup_render' do