system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
import os

import click

from bioblend import galaxy
from parsec.cli import pass_context
from parsec import config
from parsec.io import warn, info

CONFIG_TEMPLATE = """## Parsec Global Configuration File.
# Each stanza should contian a single galaxy server to control.
#
# You can set the key __default to the name of a default instance
__default: local

local:
    key: "%(key)s"
    url: "%(url)s"
"""

SUCCESS_MESSAGE = (
    "Ready to go! Type `parsec` to get a list of commands you can execute."
)


@click.command("config_init")
@click.option(
    "--url",
    help="your Galaxy's URL",
    type=str
)
@click.option(
    "--api_key",
    help="your Galaxy API Key",
    type=str
)
@pass_context
def cli(ctx, url=None, api_key=None, admin=False, **kwds):
    """Help initialize global configuration (in home directory)
    """
    # TODO: prompt for values someday.
    click.echo("""
Welcome to
      ____   ____ _   _____   _____  ___   _____
     / __ \ / __ `/  / ___/  / ___/ / _ \ / ___/
    / /_/ // /_/ /  / /     (__  ) /  __// /__
   / .___/ \__,_/  /_/     /____/  \___/ \___/
  /_/ Galaxy at the Speed of Light
""")
    config_path = config.global_config_path()

    if os.path.exists(config_path):
        info("Your parsec configuration already exists. Please edit it instead: %s" % config_path)
        return 0

    while True:
        galaxy_url = url
        if url is None or len(url) == 0 :
            galaxy_url = click.prompt("Please enter your Galaxy's URL")
        galaxy_key = api_key
        if api_key is None or len(api_key) == 0 :
            galaxy_key = click.prompt("Please enter your Galaxy API Key")
        info("Testing connection...")
        gi = galaxy.GalaxyInstance(galaxy_url, galaxy_key)
        try:
            conf = gi.config.get_config()
            if 'version_major' in conf:
                # Ok, success
                info("Ok! Everything looks good.")
                break
            else:
                warn("Error, we could not access the configuration data for your instance.")
                should_break = click.prompt("Continue despite inability to contact this Galaxy Instance? [y/n]")
                if should_break in ('Y', 'y'):
                    break
        except Exception as e:
            warn_msg = ("Error, we could not access the configuration data for your instance. "
                        "The server responded with error code %s. If your galaxy uses remote_user "
                        "authentication (i.e. as username + password is requested if you try to curl "
                        "or wget %s.) If this is the case, you may need to add an exception for the "
                        "Galaxy API. Please see https://galaxyproject.org/admin/config/apache-external-user-auth/ "
                        "or https://galaxyproject.org/admin/config/nginx-external-user-auth/ for more information.)")
            warn(warn_msg, e.status_code, galaxy_url)
            should_break = click.prompt("Continue despite inability to contact this Galaxy Instance? [y/n]")
            if should_break in ('Y', 'y'):
                break

    if os.path.exists(config_path):
        warn("File %s already exists, refusing to overwrite." % config_path)
        return -1
    with open(config_path, "w") as f:
        f.write(
            CONFIG_TEMPLATE % {
                'key': galaxy_key,
                'url': galaxy_url,
            })
        info(SUCCESS_MESSAGE)

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-295: Improper Certificate Validation
  B) CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  C) CWE-117: Improper Output Neutralization for Logs
  D) CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
  E) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  F) CWE-312: Cleartext Storage of Sensitive Information
Answer: F