# What binding libraries are safe for WebExtensions?

**URL:** <https://discourse.mozilla.org/t/what-binding-libraries-are-safe-for-webextensions/23680>\
**Category:** Development\
**Created:** [December 21, 2017, 12:37am UTC](https://discourse.mozilla.org/t/what-binding-libraries-are-safe-for-webextensions/23680 "2017-12-21T00:37:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![eccenux](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/eccenux/32/18219_2.png) [@eccenux](https://discourse.mozilla.org/u/eccenux)\
**Post date:** [December 21, 2017, 12:37am UTC](https://discourse.mozilla.org/t/what-binding-libraries-are-safe-for-webextensions/23680/1 "2017-12-21T00:37:50Z")

</div>

So I need to create a settings form that has some dynamic stuff in it. I wanted to use Knockout.js as it is lightweight and doesn’t have external dependencies… But I just learned I cannot use it in Firefox because Knockout uses eval. 😕

So. Is there some recommended list of frameworks that were tested to work? Preferably something lite and not using 100 node modules 😉

---

<div class="post-metadata">

**Author:** ![lidel](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/lidel/32/30685_2.png) [@lidel](https://discourse.mozilla.org/u/lidel)\
**Post date:** [December 21, 2017, 5:30pm UTC](https://discourse.mozilla.org/t/what-binding-libraries-are-safe-for-webextensions/23680/2 "2017-12-21T17:30:40Z")

</div>

AMO has a list of whitelisted libraries that do not trigger manual review:

> <https://github.com/mozilla/amo-validator/blob/master/validator/testcases/hashes-allowed.txt>

If you want to use webpack or other build tool, check tips at the end of this thread:

> [@Automated addon approval should verify library hashes](https://discourse.mozilla.org/t/automated-addon-approval-should-verify-library-hashes/21399):
>
> Hi there, I’ve recently uploaded an update to my addon and it got auto-approved by the addon validation. Unfortunately it was removed from AMO just a few hours later because one of the included libraries didn’t match any known hash values (my IDE replaced all Unix newlines LF with Windows newlines CR+LF…). It would be really helpful if the automated addon validation would display a warning about mismatching/unknown hashes. From a security perspective it might even be considered to block such…

---

<div class="post-metadata">

**Author:** ![eccenux](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/eccenux/32/18219_2.png) [@eccenux](https://discourse.mozilla.org/u/eccenux)\
**Post date:** [December 21, 2017, 10:11pm UTC](https://discourse.mozilla.org/t/what-binding-libraries-are-safe-for-webextensions/23680/3 "2017-12-21T22:11:37Z")

</div>

Thanks! Angular 1.6 seem to be working fine 🙂 .