'Report if we have sensitive methods enabled via CORS.
:return: A list of vulnerability objects with the identified vulns
(if any).'

def _allow_methods(self, forged_req, url, origin, response, allow_origin, allow_credentials, allow_methods):

    if (allow_methods is None):
        return
    allow_methods_list = allow_methods.split(',')
    allow_methods_list = [m.strip() for m in allow_methods_list]
    allow_methods_list = [m.upper() for m in allow_methods_list]
    allow_methods_set = set(allow_methods_list)
    report_sensitive = set()
    for sensitive_method in self.SENSITIVE_METHODS:
        if (sensitive_method in allow_methods_set):
            report_sensitive.add(sensitive_method)
    report_strange = set()
    for allowed_method in allow_methods_set:
        if (allowed_method not in self.COMMON_METHODS):
            report_strange.add(allowed_method)
    if (not (len(report_sensitive) or len(report_strange))):
        return
    if report_sensitive:
        name = 'Sensitive    CORS    methods    enabled'
        msg = 'The    remote    Web    application,    specifically    "%s",    returned    a    "%s"    header    with    the    value    set    to    "%s"    which    is    insecure    since    it    allows    the    following    sensitive    HTTP    methods:    %s.'
        msg %= (url, ACCESS_CONTROL_ALLOW_METHODS, allow_methods, ',    '.join(report_sensitive))
        v = Vuln(name, msg, severity.LOW, response.get_id(), self.get_name())
        v.set_url(forged_req.get_url())
        v[METHODS] = allow_methods_set
        self.kb_append_uniq_group(self, 'cors_origin', v, group_klass=SensitiveMethodsInfoSet)
    if report_strange:
        name = 'Uncommon    CORS    methods    enabled'
        msg = 'The    remote    Web    application,    specifically    "%s",    returned    a    "%s"    header    with    the    value    set    to    "%s"    which    is    insecure    since    it    allows    the    following    uncommon    HTTP    methods:    %s.'
        msg %= (url, ACCESS_CONTROL_ALLOW_METHODS, allow_methods, ',    '.join(report_strange))
        v = Vuln(name, msg, severity.LOW, response.get_id(), self.get_name())
        v.set_url(forged_req.get_url())
        v[METHODS] = allow_methods_set
        self.kb_append_uniq_group(self, 'cors_origin', v, group_klass=StrangeMethodsInfoSet)
