system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from __future__ import unicode_literals
import codecs
import json
import os
import re
import sys

from bs4 import BeautifulSoup
from jinja2 import Environment, FileSystemLoader
import requests
from weasyprint import HTML


def fetch_url(url):
    url = url.group(0)
    try:
        req = requests.get(url, timeout=10)
        soup = BeautifulSoup(req.text, 'html.parser')
        return '<a href="%s">%s</a> (%s)' % (url, url, soup.title.string)
    except:
        return url


def grab_urls(text):
    urls = '(?: %s)' % '|'.join("""http telnet gopher file wais
    ftp""".split())
    ltrs = r'\w'
    gunk = r'/#~:.?+=&%@!\-'
    punc = r'.:?\-'
    any = "%(ltrs)s%(gunk)s%(punc)s" % {'ltrs': ltrs,
                                        'gunk': gunk,
                                        'punc': punc}

    url = r"""
        \b                            # start at word boundary
            %(urls)s    :             # need resource and a colon
            [%(any)s]  +?             # followed by one or more
                                      #  of any valid character, but
                                      #  be conservative and take only
                                      #  what you need to....
        (?=                           # look-ahead non-consumptive assertion
                [%(punc)s]*           # either 0 or more punctuation
                (?:   [^%(any)s]      #  followed by a non-url char
                    |                 #   or end of the string
                      $
                )
        )
        """ % {'urls': urls,
               'any': any,
               'punc': punc}

    url_re = re.compile(url, re.VERBOSE | re.MULTILINE)
    """Given a text string, returns all the urls we can find in it."""
    return url_re.sub(fetch_url, text)


def resolve_links(value):
    # print(grab_urls(value))
    return grab_urls(value)


sys.stdout = codecs.getwriter('utf8')(sys.stdout)
sys.stderr = codecs.getwriter('utf8')(sys.stderr)

ENV = Environment(loader=FileSystemLoader("templates"))
ENV.filters['resolve_links'] = resolve_links
TEMPLATE = ENV.get_template('dossier.html')


def export_answers(answers, out_dir):
    rendered = TEMPLATE.render(answers=answers)
    if "lastname_uk" in answers[0]["task"]["data"]:
        reg_dir = os.path.join(out_dir, answers[0]["task"]["data"]["region"])

        if not os.path.exists(reg_dir):
            os.makedirs(reg_dir)

        fname = "%s/%s %s %s.pdf" % (
            answers[0]["task"]["data"]["region"],
            answers[0]["task"]["data"]["lastname_uk"],
            answers[0]["task"]["data"]["firstname_uk"],
            answers[0]["task"]["data"]["patronymic_uk"])
    else:
        fname = "%s.pdf" % answers[0]["task"]["id"]

    HTML(string=rendered).write_pdf(os.path.join(out_dir, fname))

if __name__ == '__main__':
    if len(sys.argv) < 3:
        exit("Not enough arguments")

    in_file = sys.argv[1]
    out_dir = sys.argv[2]

    with open(in_file, "r") as fp_in:
        for i, l in enumerate(fp_in):
            answers = json.loads(l)

            if answers:
                export_answers(answers, out_dir)

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-94: Improper Control of Generation of Code ('Code Injection')
  B) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  C) CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  D) CWE-326: Inadequate Encryption Strength
  E) CWE-312: Cleartext Storage of Sensitive Information
  F) CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
Answer: B