'Quote: "The above example would fail if the header was wildcarded as:
Access-Control-Allow-Origin: *.  Since the Access-Control-Allow-Origin
explicitly mentions http://foo.example, the credential-cognizant content
is returned to the invoking web content.  Note that in line 23, a
further cookie is set."
https://developer.mozilla.org/en-US/docs/HTTP_access_control
This method detects this bad implementation, which this is not a vuln
it might be interesting for the developers and/or security admins.
:return: Any implementation errors (as vuln objects) that might be found'

def _universal_origin_allow_creds(self, forged_req, url, origin, response, allow_origin, allow_credentials_str, allow_methods):

    allow_credentials = False
    if (allow_credentials_str is not None):
        allow_credentials = ('true' in allow_credentials_str.lower())
    if (allow_credentials and (allow_origin == '*')):
        msg = 'The    remote    Web    application,    specifically    "%s",    returned    a    "%s"    header    with    the    value    set    to    "*"        and    an    %s    header    with    the    value    set    to    "true"    which    according    to    Mozilla\'s    documentation    is    invalid.    This    implementation    error    might    affect    the    application    behavior.'
        msg = (msg % (forged_req.get_url(), ACCESS_CONTROL_ALLOW_ORIGIN, ACCESS_CONTROL_ALLOW_CREDENTIALS))
        v = Vuln('Incorrect    withCredentials    implementation', msg, severity.INFORMATION, response.get_id(), self.get_name())
        v.set_url(forged_req.get_url())
        v[DOMAIN] = forged_req.get_url().get_domain()
        self.kb_append_uniq_group(self, 'cors_origin', v, group_klass=IncorrectWithCredsInfoSet)
