Escape username for regex

[DominikSerafin]

Currently when the usernameCaseInsensitive option is enabled then username is queried using regex constructed from unescaped username value.

This is a bit problematic because username can often contain special characters - e.g. it can be [email protected] email address.

When we construct regex from that value then it will treat plus sign as a regex quantifier rather than character match. Here's how it fails:

const username = '[email protected]';
new RegExp(`^${username}$`, 'i').test(username) // = false

And this leads to inability to authenticate using that email address after it was used for registration. It can also potentially lead to some security/stability vulnerabilities, like e.g. ReDoS.

My solution here is to escape regex token characters in username before that value gets put into RegExp constructor.

[coveralls]

Coverage decreased (-0.4%) to 97.685% when pulling e20d3fc on DominikSerafin:patch-1 into 7992af4 on saintedlama:master.

[dannymout]

What's the status on this?