#fixed code
                                @Test
    public void testReadingEscapedXml() throws Exception {
        // given
        xmlRecordReader = new XmlRecordReader("website", getDataSource("/websites.xml"));
        xmlRecordReader.open();

        // when
        XmlRecord record1 = xmlRecordReader.readRecord();
        XmlRecord record2 = xmlRecordReader.readRecord();
        XmlRecord record3 = xmlRecordReader.readRecord();
        XmlRecord record4 = xmlRecordReader.readRecord();
        XmlRecord record5 = xmlRecordReader.readRecord();
        XmlRecord record6 = xmlRecordReader.readRecord();

        // then
        assertThat(record1.getPayload()).isXmlEqualTo("<website name=\"google\" url=\"http://www.google.com?query=test&amp;sort=asc\"/>");
        assertThat(record2.getPayload()).isXmlEqualTo("<website name=\"l&apos;equipe\" url=\"http://www.lequipe.fr\"/>");
        assertThat(record3.getPayload()).isXmlEqualTo("<website name=\"l&quot;internaute.com\" url=\"http://www.linternaute.com\"/>");
        assertThat(record4.getPayload()).isXmlEqualTo("<website name=\"google\">http://www.google.com?query=test&amp;sort=asc</website>");
        assertThat(record5.getPayload()).isXmlEqualTo("<website name=\"test\">&lt;test&gt;foo&lt;/test&gt;</website>");
        assertThat(record6).isNull();
    }
#vulnerable code 
                                @Test
    public void testReadingEscapedXml() throws Exception {
        xmlRecordReader.close();
        xmlRecordReader = new XmlRecordReader("website", getDataSource("/websites.xml"));
        xmlRecordReader.open();
        XmlRecord record = xmlRecordReader.readRecord();
        assertThat(record.getPayload()).isXmlEqualTo("<website name=\"google\" url=\"http://www.google.com?query=test&amp;sort=asc\"/>");

        record = xmlRecordReader.readRecord();
        assertThat(record.getPayload()).isXmlEqualTo("<website name=\"l&apos;equipe\" url=\"http://www.lequipe.fr\"/>");

        record = xmlRecordReader.readRecord();
        assertThat(record.getPayload()).isXmlEqualTo("<website name=\"l&quot;internaute.com\" url=\"http://www.linternaute.com\"/>");

        record = xmlRecordReader.readRecord();
        assertThat(record.getPayload()).isXmlEqualTo("<website name=\"google\">http://www.google.com?query=test&amp;sort=asc</website>");

        record = xmlRecordReader.readRecord();
        assertThat(record.getPayload()).isXmlEqualTo("<website name=\"test\">&lt;test&gt;foo&lt;/test&gt;</website>");

        record = xmlRecordReader.readRecord();
        assertThat(record).isNull();

    } 
                            #location 10 
                            #vulnerability type NULL_DEREFERENCE