XSS bug in wiki markup link rendering

// in private boolean isUrlLink(String textWithoutTitle)

        if (textWithoutTitle.startsWith("mailto:") || textWithoutTitle.startsWith("file:"))
        {
            return true;
        }
        else
        {
            // URLs don't strictly allow single quote characters, but we want to allow one
            String encodedText = textWithoutTitle.replaceAll("'","");
            boolean isUrl = UrlUtils.verifyHierachicalURI(encodedText);
            return isUrl;
        }