system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
from __future__ import absolute_import, unicode_literals
from hashlib import sha1
from pyfondy.configuration import __sign_sep__ as sep
from pyfondy.exceptions import RequestError
from uuid import uuid4

import pyfondy.utils as utils


def get_data(data, req_type):
    """
    :param data: data to prepare
    :param req_type: request type
    :return: prepared data
    """
    if req_type == 'json':
        return utils.to_json(data)
    if req_type == 'xml':
        return utils.to_xml(data)
    if req_type == 'form':
        return utils.to_form(data.get('request'))


def get_request_type(req_type):
    """
    :param req_type: request type
    :return: post header
    """
    types = {
        'json': 'application/json; charset=utf-8',
        'xml': 'application/xml; charset=utf-8',
        'form': 'application/x-www-form-urlencoded; charset=utf-8'
    }
    return types.get(req_type, types['json'])


def get_signature(secret_key, params, protocol):
    """
    :param secret_key: merchant secret
    :param params: post params
    :param protocol: api protocol version
    :return: signature string
    """
    if protocol == '2.0':
        str_sign = sep.join([secret_key, params])
        calc_sign = sha1(str_sign.encode('utf-8')).hexdigest()
        return calc_sign
    else:
        data = [secret_key]
        data.extend([str(params[key]) for key in sorted(iter(params.keys()))
                     if params[key] != '' and not params[key] is None])
        return sha1(sep.join(data).encode('utf-8')).hexdigest()


def check_currency(currency):
    if currency.upper() not in ['UAH', 'RUB', 'USD', 'EUR', 'GBR', 'CZK']:
        raise ValueError('currency must be UAH, RUB, USD, EUR, GBR or CZK')


def check_verification_type(verification_type):
    if verification_type not in ['amount', 'code', None]:
        raise ValueError('verification_type must be "amount" or "code"')


def get_desc(order_id):
    """
    :param order_id: order id
    :return: description string
    """
    return 'Pay for order #: %s' % order_id


def generate_order_id():
    """
    :return: unic order id
    """
    return str(uuid4())


def check_data(data):
    """
    :param data: required data
    :return: checking required data not empty
    """
    for key, value in data.items():
        if value == '' or None:
            raise RequestError(key)
        if key == 'amount':
            try:
                int(value)
            except ValueError:
                raise ValueError('Amount must numeric')


def is_valid(data, secret_key, protocol):
    if 'signature' in data:
        result_signature = data['signature']
        del data['signature']
    else:
        raise ValueError('Incorrect data')
    if 'response_signature_string' in data:
        del data['response_signature_string']
    signature = get_signature(secret_key=secret_key,
                              params=data,
                              protocol=protocol)
    return result_signature == signature


def is_approved(data, secret_key, protocol):
    if 'order_status' not in data:
        raise ValueError('Incorrect data')
    if not is_valid(data, secret_key, protocol):
        raise Exception('Payment invalid')
    return data.get('order_status') == 'approved'

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-327: Use of a Broken or Risky Cryptographic Algorithm
  B) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  C) CWE-918: Server-Side Request Forgery (SSRF)
  D) CWE-116: Improper Encoding or Escaping of Output
  E) CWE-312: Cleartext Storage of Sensitive Information
  F) CWE-94: Improper Control of Generation of Code ('Code Injection')
Answer: A