#fixed code
                                @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
    	//resp.addHeader("Access-Control-Allow-Origin", "*");
        //Try login
        // Does not require admini rights.
        LoggedIn mLoggedIn = Session.webappLogin(req, resp, false).getLogin();
        //servletLogin(req, resp, true);//auth.login(user, pass);

        if (mLoggedIn == null) {
            resp.sendError(401, "Login failed");
            return;
        }

        JSONObject json_resp = new JSONObject();
        json_resp.put("user", mLoggedIn.getUserName());
        json_resp.put("admin", mLoggedIn.isAdmin());
        User u = UsersStruct.getInstance().getUser(mLoggedIn.getUserName());
        JSONArray rolesObj = new JSONArray();
        if (u!=null&&u.getRoles()!=null) {
            for (Role r : u.getRoles()) {
                if (r!=null)
                    rolesObj.add(r.getName());
            }

            json_resp.put("roles", rolesObj);
        }
        json_resp.put("token", mLoggedIn.getToken());

        //Set response content type
        resp.setContentType("application/json");

        //Write response
        json_resp.write(resp.getWriter());
    }
#vulnerable code 
                                @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
    	//resp.addHeader("Access-Control-Allow-Origin", "*");
        //Try login
        // Does not require admini rights.
        LoggedIn mLoggedIn = Session.webappLogin(req, resp, false).getLogin();
        //servletLogin(req, resp, true);//auth.login(user, pass);

        if (mLoggedIn == null) {
            resp.sendError(401, "Login failed");
            return;
        }

        JSONObject json_resp = new JSONObject();
        json_resp.put("user", mLoggedIn.getUserName());
        json_resp.put("admin", mLoggedIn.isAdmin());
        User u = UsersStruct.getInstance().getUser(mLoggedIn.getUserName());
        JSONArray rolesObj = new JSONArray();
        for (Role r : u.getRoles())
        {
            rolesObj.add(r.getName());
        }

        json_resp.put("roles", rolesObj);
        json_resp.put("token", mLoggedIn.getToken());

        //Set response content type
        resp.setContentType("application/json");

        //Write response
        json_resp.write(resp.getWriter());
    } 
                            #location 19 
                            #vulnerability type NULL_DEREFERENCE