fix dynamic RegExp generation

[inkz]

It is insecure to use eval() for turning user input into a regular expression, native way of doing this would be to utilize RegExp consturctor new RegExp().

[longmore]

张荣谋收到，谢谢！