'Verify if the cookie has the httpOnly parameter set
Reference:
http://www.owasp.org/index.php/HTTPOnly
http://en.wikipedia.org/wiki/HTTP_cookie
:param request: The http request object
:param response: The http response object
:param cookie_obj: The cookie object to analyze
:param cookie_header_value: The cookie, as sent in the HTTP response
:param fingerprinted: True if the cookie was fingerprinted
:return: None'

def _http_only(self, request, response, cookie_obj, cookie_header_value, fingerprinted):

    if (not self.HTTPONLY_RE.search(cookie_header_value)):
        vuln_severity = (severity.MEDIUM if fingerprinted else severity.LOW)
        desc = 'A    cookie    without    the    HttpOnly    flag    was    sent    when        requesting    "%s".    The    HttpOnly    flag    prevents    potential    intruders    from    accessing    the    cookie    value    through    Cross-Site    Scripting    attacks.'
        desc = (desc % response.get_url())
        v = CookieVuln('Cookie    without    HttpOnly', desc, vuln_severity, response.id, self.get_name())
        v.set_url(response.get_url())
        v.set_cookie_object(cookie_obj)
        self.kb_append_uniq_group(self, 'http_only', v, group_klass=HttpOnlyCookieInfoSet)
