Escape user-provided text passed to regex

Rather than using the user/document-provided values directly, we instead
escape them to use them verbatim.

This fixes issue #568.

src/documents/models.py

@@ -141,7 +141,9 @@ def _split_match(self):
  findterms = re.compile(r'"([^"]+)"|(\S+)').findall
  normspace = re.compile(r"\s+").sub
  return [
- normspace(" ", (t[0] or t[1]).strip()).replace(" ", r"\s+")
+ re.escape(
+ normspace(" ", (t[0] or t[1]).strip())
+ ).replace(r"\ ", "\s+")
  for t in findterms(self.match)
  ]