Adding the CORS header to allow from any domain on two URLs

I am trying to add the CORS header to allow from any domain on two URLs. The files are a .xml and .json extensions and are located in subfolders in the document root like $SITE/test/test.xml and $SITE/test/test.json (Just an example, Not the correct URLs). How can i add the rules to allow access for these URLs through Cloudflare. I have tried our adding different set of options from Security >> WAF and also from the Rules options but this is not working. Thanks in advance for the support.