
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@getodk/web-forms
Advanced tools
This package is a Vue component library that uses @getodk/xforms-engine
to render ODK XForms. These forms are generally authored by end users in Excel using the XLSForm standard. Learn more on the ODK website and the ODK Web Form project's main README.
To use this library in a Vue.js application:
@getodk/web-forms
as a dependency in the applicationapp.use(WebFormsPlugin)
in entry component (usually App.vue)<OdkWebForm
:form-xml="formXml"
:fetch-form-attachment="fetchAttachment"
:missing-resource-behavior="missingBehavior"
:submission-max-size="5242880" <!-- 5MB -->
:edit-instance="editOptions"
@submit="handleSubmit"
@submit-chunked="handleChunkedSubmit"
/>
The plugin is there to initialize PrimeVue, currently it exposes no options. In the future, configuration options may be added to the plugin.
import { WebFormsPlugin } from '@getodk/web-forms';
app.use(WebFormsPlugin);
OdkWebFormsProps
)The <OdkWebForm>
component accepts the following props:
formXml
(string
, required): The XML of the ODK XForm to be renderedfetchFormAttachment
(FetchFormAttachment
, required): Function to fetch form attachmentsmissingResourceBehavior
(MissingResourceBehavior
, optional): Defines behavior when resources are missingsubmissionMaxSize
(number
, optional): Maximum size for chunked submissions. Required when subscribing to submitChunked
eventeditInstance
(EditInstanceOptions
, optional): Options to resolve and load instance and attachment resources for editingOdkWebFormEmits
)The component emits the following events:
submit
: Emitted when the user presses the "Send" button on a valid form
submitChunked
: Emitted for chunked submissions when the form is valid
submissionMaxSize
prop to be setWe will eventually publish a framework-agnostic custom element.
To run in development, run this command at the monorepo root:
yarn workspace @getodk/web-forms dev
Individual test environments, and their corresponding watch modes, also have separate commands which can be found in package.json
.
Upload XLSForm and XForm functionality in demo
app and in dev mode depends on XLSForm-online. Run the xlsform-online locally. By default it runs on port 8000, if you are running it on another port then you should update the config
file.
web-forms/
├── public/ # Static assets (e.g., favicon.ico)
├── src/
│ ├── assets/
│ │ ├── images/ # Web Forms and Demo page images
│ │ ├── styles/ # Web Forms and Demo page styles
│ ├── components/ # UI components
│ │ ├── form-elements/ # Form elements or controllers (question types, hints, labels, inputs)
│ │ ├── form-layout/ # Form layout and rendering (e.g., form panel, groups, repeats, form error classes)
│ │ ├── common/ # Reusable smaller components (e.g., icon, image, checkbox components)
│ ├── demo/ # Demo page
│ ├── lib/ # Utilities
│ ├── index.ts
│ ├── web-forms-plugin.ts # Vue plugin
├── tests/ # Unit tests
├── e2e/ # E2e tests
├── package.json
├── vite.config.ts
├── playwright.config.ts
This project uses a combination of PrimeFlex and PrimeVue for consistent styling, alongside specific font rules for the ODK Website's Web Forms Preview.
We use CSS variables for theming with two prefixes:
--p-
Prefix: Variables prefixed with --p-
(e.g., --p-primary-50
) come from PrimeVue and control its component styles (e.g., colors, borders). These are part of PrimeVue’s theming system.--odk-
Prefix: Variables prefixed with --odk-
(e.g., --odk-font-family
) are custom to this project and manage styles outside PrimeVue or PrimeFlex, such as application-specific typography.This package uses a centralized z-index
layering system to manage UI stacking order, defined in src/assets/styles/style.scss
. The ODK variables (e.g., --odk-z-index-error-banner
) ensure elements like floating error messages, form controls, and overlays stack correctly without overlap.
Key layers:
--odk-z-index-base
(background)--odk-z-index-form-content
(inputs, buttons)--odk-z-index-form-floating
(highlights, tooltips)--odk-z-index-error-banner
(floating errors)--odk-z-index-overlay
(modals)--odk-z-index-topmost
(loaders, notifications)Usage: Apply with z-index: var(--odk-z-index-error-banner);
on positioned elements (e.g., position: absolute
).
Form elements use font-family: Roboto, sans-serif;
for accessibility and a clean, readable appearance.
This package uses the Material Design system for the UI, though not strictly. The idea is to closely match the design to that of ODK Collect.
The IconSVG
component renders Material Design Icons (MDI) with customizable size and style variants. It uses the @mdi/js
library for icon data and supports a predefined set of icons.
<IconSVG name="mdiCamera" size="md" variant="primary" />
To add a new icon:
@mdi/js
in the IconSVG
component.iconMap
object with its corresponding name.name
prop.Material Icons are available under the Apache License Version 2.0. Copy of the license can be found at ./src/assets/fonts/LICENSE-2.0.txt
FAQs
ODK Web Forms
We found that @getodk/web-forms demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.