Skip to content

Enriching OracleParameterInfo with flag for PII data and Fix OracleDecimal to System.Decimal conversion overflow handling#75

Open
opejanovic wants to merge 12 commits into
DIPSAS:mainfrom
opejanovic:main
Open

Enriching OracleParameterInfo with flag for PII data and Fix OracleDecimal to System.Decimal conversion overflow handling#75
opejanovic wants to merge 12 commits into
DIPSAS:mainfrom
opejanovic:main

Conversation

@opejanovic
Copy link
Copy Markdown
Contributor

PII Data

I submitted a pull request to the project, introducing a new flag called MaskValueWhenLogging to the OracleParameterInfo class.

This flag is intended to identify Oracle parameters that contain Personally Identifiable Information (PII). When set to true, it enables masking of parameter values in logs, improving data security and supporting compliance with privacy regulations.

I find this flag very useful in practice. Here's a simple example demonstrating how it can be used to mask sensitive parameter values before logging:

`var paramDic = new Dictionary<string, string>();
foreach (var name in parameters?.ParameterNames)
{
var paramInfo = parameters.GetParameter(name);

string paramValue;

if (paramInfo.MaskValueWhenLogging)
{
    paramValue = "***MASKED***";
}
else
{
    paramValue = GetParameterValue<dynamic>(parameters, name);
}
paramDic.Add(name, paramValue);

}
logger.LogInformation("SQL executed wiht {@parameters}", paramDic);`

This approach helps ensure that PII or other sensitive values are not exposed in logs while still retaining visibility into which parameters were used.

Fix OracleDecimal to System.Decimal conversion overflow handling

Added explicit handling for Oracle NUMBER values that exceed the precision supported by System.Decimal.

Oracle NUMBER can store up to 38 digits of precision, while System.Decimal supports up to 28-29 digits. In some cases, ODP.NET throws an overflow exception during OracleDecimal to decimal conversion, causing Dapper mapping failures.

The fix applies precision normalization before converting OracleDecimal to System.Decimal to maintain compatibility with legacy ADO.NET behavior and prevent runtime overflow exceptions during result materialization.

Added a new flag, MaskValueWhenLogging, to the OracleParameterInfo class. This flag is used to identify Oracle parameters containing Personally Identifiable Information (PII). When set to true, the parameter values can be masked in logs to enhance data security and compliance with privacy standards.
@opejanovic
Copy link
Copy Markdown
Contributor Author

@epaulsen can you please review this or assign somebody else to do it?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant