'Check if the allow_origin is set to *.
:return: A list of vulnerability objects with the identified vulns
(if any).'

def _universal_allow(self, forged_req, url, origin, response, allow_origin, allow_credentials, allow_methods):

    if (allow_origin == '*'):
        msg = 'The    remote    Web    application,    specifically    "%s",    returned    an    %s    header    with    the    value    set    to    "*"    which    is    insecure    and    leaves    the    application    open    to    Cross-domain    attacks.'
        msg %= (forged_req.get_url(), ACCESS_CONTROL_ALLOW_ORIGIN)
        v = Vuln('Access-Control-Allow-Origin    set    to    "*"', msg, severity.LOW, response.get_id(), self.get_name())
        v.set_url(forged_req.get_url())
        v[DOMAIN] = forged_req.get_url().get_domain()
        self.kb_append_uniq_group(self, 'cors_origin', v, group_klass=UniversalAllowInfoSet)
