system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
"""Blueprint for user interface (the single page app) entry points"""
from flask import Blueprint, Response, g, redirect, render_template, request, send_file
from flask_security import current_user, login_required

from common.config import get_config
from ...flask_modules.jwt import create_jwt_for_user

_CONFIG = get_config()

UI_BP = Blueprint('ui', __name__, url_prefix='/%s/ui' % _CONFIG.get('DEFAULT', 'version'))
UI_NONAUTH_BP = Blueprint('ui_nonauth', __name__)


@UI_BP.route('/static/app.js')
def appjs() -> Response:
    """:return: the single page javascript app"""
    return send_file('static/app.js')


def _hand_off_to_app(path: str) -> Response:
    return render_template('ui.html',
                           bot_id=_CONFIG.get("BOT", "client_id"),
                           jwt=create_jwt_for_user(current_user
                                                   if current_user.has_role('tagger')
                                                   else g.demo_user),
                           auth_token=(
                               current_user.get_auth_token()
                               if current_user.has_role('tagger')
                               else g.demo_user.get_auth_token()),
                           path=path,
                           version=_CONFIG.get('DEFAULT', 'version'))


@UI_NONAUTH_BP.route('/legal')
@UI_NONAUTH_BP.route('/team')
@UI_NONAUTH_BP.route('/enterprise')
def nonauth() -> Response:
    """Other (landing) pages implemented by the single page app."""
    return _hand_off_to_app(request.path)


@UI_NONAUTH_BP.route('/v1/<path:path>')
@UI_NONAUTH_BP.route('/v2/<path:path>')
@UI_NONAUTH_BP.route('/v3/<path:path>')
def redir_old_new(path: str) -> Response:
    """Redirects call to old versions to the new version"""
    return redirect('/%s/%s' % (_CONFIG.get('DEFAULT', 'version'), path))


@UI_BP.route('/', defaults={'path': ''})
@UI_BP.route('/<path:path>')
@login_required
def root(path: str) -> Response:
    """Catch all for ui paths. Hands the path off to the single page app."""
    return _hand_off_to_app(path)

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-94: Improper Control of Generation of Code ('Code Injection')
  B) CWE-312: Cleartext Storage of Sensitive Information
  C) CWE-611: Improper Restriction of XML External Entity Reference
  D) CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
  E) CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
  F) CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Answer: D