🛡️ Fix unescaped RegExp construction in LivechatRooms model

Description

While reviewing the LivechatRooms model, I noticed that several methods construct RegExp objects directly from external inputs (such as email thread IDs and custom field values) without escaping them first.

This appears to be a latent issue rather than a currently reported crash, but it can lead to incorrect query behavior and unnecessary risk.

---

Why this matters

1. Query correctness
Email thread IDs and custom field values can legitimately contain regex metacharacters such as ., +, ?, or * (common in email-related data).
When passed unescaped into new RegExp(), these values may:

Fail to match existing rooms

Return incorrect or unexpected results

2. Defensive hardening
Escaping external inputs before regex construction helps prevent pathological patterns and avoids potential Regular Expression Denial of Service (ReDoS) scenarios.
This is a preventative hardening step rather than a reaction to an active vulnerability.

Proposed scope (low-risk, localized)

Standardize regex creation in the LivechatRooms model by ensuring all external inputs are escaped before being passed to new RegExp().

Affected methods:

updateDataByToken (custom field values)

findOneByVisitorTokenAndEmailThread

findOneByVisitorTokenAndEmailThreadAndDepartment

findOneOpenByVisitorTokenAndEmailThread

This change would not alter query intent or data structures - only how inputs are safely handled.

---

Verification plan

Automated testing

Extend existing LivechatRooms tests (if present) to include:

Thread IDs containing special characters (e.g. user+test@domain.com)

Custom field values with regex metacharacters

Manual verification

Confirm that omnichannel rooms with special-character thread IDs are still correctly found by the system.

Next steps

If this approach looks reasonable, I’d be happy to take this up and submit a PR with the change and corresponding tests. Kindly assign this to me.

Locate the LivechatRooms model and the four affected methods: updateDataByToken, findOneByVisitorTokenAndEmailThread, findOneByVisitorTokenAndEmailThreadAndDepartment, and findOneOpenByVisitorTokenAndEmailThread. Read any existing LivechatRooms tests, then verify behavior with thread IDs and custom field values containing regex metacharacters. Done means those inputs are handled safely and the relevant tests pass.