Method \XF\BbCode\Renderer\Html::getValidUrl() happily seems to accept input like https://this is not a valid URL! and, despite its name, does return this invalid URL.
Thank you for reporting this issue, it has now been resolved. We are aiming to include any changes that have been made in a future XF release (2.2.0 Beta 4).
Change log:
Properly check for valid URLs in the HTML BB code renderer