#fixed code
                                @Override
    public void makeBuildVariables(@SuppressWarnings("rawtypes") AbstractBuild build, Map<String,String> variables){
        variables.put("ghprbUpstreamStatus", "true");
        variables.put("ghprbCommitStatusContext", commitStatusContext);
        variables.put("ghprbTriggeredStatus", triggeredStatus);
        variables.put("ghprbStartedStatus", startedStatus);
        variables.put("ghprbStatusUrl", statusUrl);
        
        Map<GHCommitState, StringBuilder> statusMessages = new HashMap<GHCommitState, StringBuilder>(5);
        
        for (GhprbBuildResultMessage message : completedStatus) {
            GHCommitState state = message.getResult();
            StringBuilder sb;
            if (!statusMessages.containsKey(state)) {
                sb = new StringBuilder();
                statusMessages.put(state, sb);
            } else {
                sb = statusMessages.get(state);
                sb.append("\n");
            }
            sb.append(message.getMessage());
        }
        
        for (Entry<GHCommitState, StringBuilder> next : statusMessages.entrySet()) {
            String key = String.format("ghprb%sMessage", next.getKey().name());
            variables.put(key, next.getValue().toString());
        }
    }
#vulnerable code 
                                @Override
    public void makeBuildVariables(@SuppressWarnings("rawtypes") AbstractBuild build, Map<String,String> variables){
        variables.put("ghprbUpstreamStatus", "true");
        variables.put("ghprbCommitStatusContext", commitStatusContext);
        variables.put("ghprbTriggeredStatus", triggeredStatus);
        variables.put("ghprbStartedStatus", startedStatus);
        variables.put("ghprbStatusUrl", statusUrl);
        
        Map<GHCommitState, StringBuilder> statusMessages = new HashMap<GHCommitState, StringBuilder>(5);
        
        for (GhprbBuildResultMessage message : completedStatus) {
            GHCommitState state = message.getResult();
            StringBuilder sb;
            if (statusMessages.containsKey(state)){
                sb = new StringBuilder();
                statusMessages.put(state, sb);
            } else {
                sb = statusMessages.get(state);
                sb.append("\n");
            }
            sb.append(message.getMessage());
        }
        
        for (Entry<GHCommitState, StringBuilder> next : statusMessages.entrySet()) {
            String key = String.format("ghprb%sMessage", next.getKey().name());
            variables.put(key, next.getValue().toString());
        }
    } 
                            #location 19 
                            #vulnerability type NULL_DEREFERENCE