Enriching OracleParameterInfo with flag for PII data and Fix OracleDecimal to System.Decimal conversion overflow handling#75
Open
opejanovic wants to merge 12 commits into
Open
Conversation
Added a new flag, MaskValueWhenLogging, to the OracleParameterInfo class. This flag is used to identify Oracle parameters containing Personally Identifiable Information (PII). When set to true, the parameter values can be masked in logs to enhance data security and compliance with privacy standards.
Contributor
Author
|
@epaulsen can you please review this or assign somebody else to do it? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PII Data
I submitted a pull request to the project, introducing a new flag called MaskValueWhenLogging to the OracleParameterInfo class.
This flag is intended to identify Oracle parameters that contain Personally Identifiable Information (PII). When set to true, it enables masking of parameter values in logs, improving data security and supporting compliance with privacy regulations.
I find this flag very useful in practice. Here's a simple example demonstrating how it can be used to mask sensitive parameter values before logging:
`var paramDic = new Dictionary<string, string>();
foreach (var name in parameters?.ParameterNames)
{
var paramInfo = parameters.GetParameter(name);
}
logger.LogInformation("SQL executed wiht {@parameters}", paramDic);`
This approach helps ensure that PII or other sensitive values are not exposed in logs while still retaining visibility into which parameters were used.
Fix OracleDecimal to System.Decimal conversion overflow handling
Added explicit handling for Oracle NUMBER values that exceed the precision supported by System.Decimal.
Oracle NUMBER can store up to 38 digits of precision, while System.Decimal supports up to 28-29 digits. In some cases, ODP.NET throws an overflow exception during OracleDecimal to decimal conversion, causing Dapper mapping failures.
The fix applies precision normalization before converting OracleDecimal to System.Decimal to maintain compatibility with legacy ADO.NET behavior and prevent runtime overflow exceptions during result materialization.