Cannot combine selfDefending and target: browser-no-eval #610

The self defending template relies on constructing a new function, which is incompatible in environments that prevents eval-like functionality from running, for example when using a strict CSP. Normally, one would use target: "browser-no-eval" to prevent eval-like functionality from being included in the output, but selfDefending: true will be applied even though this target is chosen.

Expected Behavior

I see two possible options here:

1. The configuration validation fails and notifies the user that these two options are incompatible with each other
2. The self defending template is updated to be compatible with the browser-no-eval target

Current Behavior

The application ignores that the two options are incompatible with each other and outputs eval-like code even though eval-like behavior has been opted out by the user.

Steps to Reproduce

1. Use the following configuration:

{
  "target": "browser-no-eval",
  "selfDefending": true
}

2. Obfuscate a piece of Javascript
3. Serve the Javascript from a site with a strict script-src Content Security Policy
4. Observe that the script fails to load

Your Environment

• Obfuscator version used: 0.28.2
• Node version used: 13.12.0