Add all info from signup post to get_or_create_user

[leportella]

When creating a new user with email, the handler was not passing this information to the function get_or_create_user and the email was not being stored. This fixes this problem

[yuvipanda]

Does self.request.get_arguments() work instead?

[yuvipanda]

I also think we should explicitly list the arguments we wanna pass, since POST can contain arbitrary variables. For example, what happens if POST contains an 'id' parameter? Does that allow users to override ID? Or it might cause problems for a new paramter we introduce in the future...

[yuvipanda]

In general, never trust user input! https://www.enisa.europa.eu/publications/info-notes/the-dangers-of-trusting-user-input (and plenty of other things on the web). Always whitelist and validate that what we are getting is something we explicitly allow

[leportella]

yeah, it will probably override it. I'll have to restructure this to avoid this kind of problems.

[leportella]

the get_arguments return a dictionary but every result is a list of bytes. Like this:

{'username': [b'john'], 'pw': [b'password']}

[yuvipanda]

hmm, https://www.tornadoweb.org/en/stable/web.html#tornado.web.RequestHandler.get_arguments says it should be unicode. I wonder if this is a version thing?

But yeah, whitelisting is more important than the get_arguments

[leportella]

I'm not sure what you think is best. Could you explain please?

[yuvipanda]

ah, sorry. by 'whitelisting', I mean we should only accept and use arguments from the user explicitly, like you were doing before this PR with:

         password = self.get_body_argument('password', strip=False)

Similarly, we should have

         password = self.get_body_argument('password', strip=False)
         email = self.get_body_argument('email', strip=False)

This way, when looking at the code, we know exactly what arguments are being passed through, rather than relying on the right set of arguments to come from the user and be considered 'safe'

[yuvipanda]

What raises an AssertionError?

[leportella]

if the email is not validated by the ORM function, it will return an AssertionError. We can see this behavior being tested here:

nativeauthenticator/nativeauthenticator/tests/test_orm.py

Line 20 in 7b0953c

def test_validate_method_wrong_email(email, tmpdir, app):