Binding every field you send

The honest signup

Registration at /app/register takes a username and password:

curl -s -d 'username=alice&password=pw' http://127.0.0.1:8080/app/register

In the terminal

student@vulntech:~$ curl -s -d 'username=alice&password=pw' http://127.0.0.1:8080/app/register
Created account: {"role": "user", "username": "alice"}

You get a normal role: user account. But the app builds the new user by copying every field it received — so what happens if you send a field the form never showed you?