#fixed code
                                public static void parse(final PgDatabase database, final String command) {
        final Parser parser = new Parser(command);
        parser.expect("CREATE", "TRIGGER");

        final PgTrigger trigger = new PgTrigger();
        trigger.setName(parser.parseIdentifier());

        if (parser.expectOptional("BEFORE")) {
            trigger.setBefore(true);
        } else if (parser.expectOptional("AFTER")) {
            trigger.setBefore(false);
        }

        boolean first = true;

        while (true) {
            if (!first && !parser.expectOptional("OR")) {
                break;
            }
            if (parser.expectOptional("INSERT")) {
                trigger.setOnInsert(true);
            } else if (parser.expectOptional("UPDATE")) {
                trigger.setOnUpdate(true);
            } else if (parser.expectOptional("DELETE")) {
                trigger.setOnDelete(true);
            } else if (parser.expectOptional("TRUNCATE")) {
                trigger.setOnTruncate(true);
            } else if (first) {
                break;
            } else {
                parser.throwUnsupportedCommand();
            }

            first = false;
        }

        parser.expect("ON");

        trigger.setTableName(parser.parseIdentifier());

        if (parser.expectOptional("FOR")) {
            parser.expectOptional("EACH");

            if (parser.expectOptional("ROW")) {
                trigger.setForEachRow(true);
            } else if (parser.expectOptional("STATEMENT")) {
                trigger.setForEachRow(false);
            } else {
                parser.throwUnsupportedCommand();
            }
        }

        if (parser.expectOptional("WHEN")) {
            parser.expect("(");
            trigger.setWhen(parser.getExpression());
            parser.expect(")");
        }

        parser.expect("EXECUTE", "PROCEDURE");
        trigger.setFunction(parser.getRest());

        database.getDefaultSchema().getTable(
                trigger.getTableName()).addTrigger(trigger);
    }
#vulnerable code 
                                public static void parse(final PgDatabase database, final String command) {
        final Matcher matcher = PATTERN.matcher(command.trim());

        if (matcher.matches()) {
            final String triggerName = matcher.group(1);
            final String when = matcher.group(2);
            final String[] events = new String[3];
            events[0] = matcher.group(3);
            events[1] = matcher.group(4);
            events[2] = matcher.group(5);

            final String tableName = matcher.group(6);
            final String fireOn = matcher.group(7);
            final String procedure = matcher.group(8);

            final PgTrigger trigger = new PgTrigger();
            trigger.setBefore("BEFORE".equalsIgnoreCase(when));
            trigger.setForEachRow(
                    (fireOn != null) && "ROW".equalsIgnoreCase(fireOn));
            trigger.setFunction(procedure.trim());
            trigger.setName(triggerName.trim());
            trigger.setOnDelete(isEventPresent(events, "DELETE"));
            trigger.setOnInsert(isEventPresent(events, "INSERT"));
            trigger.setOnUpdate(isEventPresent(events, "UPDATE"));
            trigger.setTableName(tableName.trim());

            database.getDefaultSchema().getTable(
                    trigger.getTableName()).addTrigger(trigger);
        } else {
            throw new ParserException(
                    ParserException.CANNOT_PARSE_COMMAND + command);
        }
    } 
                            #location 20 
                            #vulnerability type NULL_DEREFERENCE