js/lib/pegTokenizer.pegjs.txt currently contains the following:

var base_urls = {
        'RFC'  : '//tools.ietfs.org/html/rfc%s',
        'PMID' : '//www.ncbi.nlm.nih.gov/pubmed/%s?dopt=Abstract'
    }

base_urls['RFC'] is wrong; the hostname should be tools.ietf.org .

I spotted this when looking at Firebug's HTML tab while VisualEditor was
open on https://en.wikipedia.org/wiki/MD4#Security .

Version: unspecified
Severity: normal