You should assume that the URL is not protected, i.e., that a passive eavesdropper may be able to learn what URL you are visiting.
I realize this contradicts what some other folks are claiming, so I'd better explain.
It is true that everything after the domain name is sent encrypted. For instance, if the url is
www.example.com is visible to the attacker, while the HTTP request (
GET /foo/bar.html HTTP/1.0) is encrypted. This does prevent an eavesdropper from directly seeing the path part of the URL. However, the length of the path part of the URL may be visible to the eavesdropper. In addition, other information -- such as the length of the page you visited -- may also be visible to the eavesdropper. This is a foot in the door for the attacker. There has been some research which uses this foot in the door to learn what URLs you are visiting, if the attacker can eavesdrop on your https traffic.
While there is no guarantee that these attacks will succeed, I suggest that it would be prudent to assume the worst: to assume that an eavesdropper may be able to learn what URLs you are visiting. Therefore, you should not assume that SSL/TLS hides from an eavesdropper which pages you are visiting.
Yes, https does provide integrity for the URL you visited.
P.S. One other caution: in practice, sslstrip and other man-in-the-middle attacks may be successful against many or most users, if the web site is not uses HSTS. Those attacks can violate both confidentiality and integrity of the URL. Therefore, if users are visiting web sites that are not using HSTS over an insecure network (e.g., open Wifi), you should be wary that an attacker might be able to learn what pages the users are visiting. One partial mitigation against the sslstrip threat is for users to use HTTPS Everywhere and for sites to adopt HSTS.