static int crossOriginDirective(MaState *state, cchar *key, cchar *value)
{
    HttpRoute   *route;
    char        *option, *ovalue, *tok;

    route = state->route;
    tok = sclone(value);
    while ((option = maGetNextArg(tok, &tok)) != 0) {
        option = stok(option, " =\t,", &ovalue);
        ovalue = strim(ovalue, "\"'", MPR_TRIM_BOTH);
        if (scaselessmatch(option, "origin")) {
            route->corsOrigin = sclone(ovalue);

        } else if (scaselessmatch(option, "credentials")) {
            route->corsCredentials = httpGetBoolToken(ovalue);

        } else if (scaselessmatch(option, "headers")) {
            route->corsHeaders = sclone(ovalue);

        } else if (scaselessmatch(option, "age")) {
            route->corsAge = atoi(ovalue);

        } else {
            mprLog("error appweb config", 0, "Unknown CrossOrigin option %s", option);
            return MPR_ERR_BAD_SYNTAX;
        }
    }
#if KEEP
    if (smatch(route->corsOrigin, "*") && route->corsCredentials) {
        mprLog("error appweb config", 0, "CrossOrigin: Cannot use wildcard Origin if allowing credentials");
        return MPR_ERR_BAD_STATE;
    }
#endif
    /*
        Need the options method for pre-flight requests
     */
    httpAddRouteMethods(route, "OPTIONS");
    route->flags |= HTTP_ROUTE_CORS;
    return 0;
}
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.