#fixed code
                                public static LinkedList<Submission> getSubmissions(String redditName,
                       Popularity type, Page frontpage, User user) throws IOException, ParseException {

        LinkedList<Submission> submissions = new LinkedList<Submission>();
        String urlString = "/r/" + redditName;
        RestClient restClient = new HttpRestClient();

        switch (type) {
            case NEW:
                urlString += "/new";
                break;
		default:
			break;
        }

        //TODO Implement Pages

        urlString += ".json";

        JSONObject object = (JSONObject)  restClient.get(urlString, user.getCookie());
        JSONArray array = (JSONArray) ((JSONObject) object.get("data")).get("children");

        JSONObject data;
        for (int i = 0; i < array.size(); i++) {
            data = (JSONObject) array.get(i);
            data = ((JSONObject) data.get("data"));
            submissions.add(new Submission(user, data.get("id").toString(), (data.get("permalink").toString())));
        }

        return submissions;
    }
#vulnerable code 
                                public static LinkedList<Submission> getSubmissions(String redditName,
                       Popularity type, Page frontpage, User user) throws IOException, ParseException {

        LinkedList<Submission> submissions = new LinkedList<Submission>();
        String urlString = "/r/" + redditName;
        RestClient restClient = new Utils();

        switch (type) {
            case NEW:
                urlString += "/new";
                break;
		default:
			break;
        }

        //TODO Implement Pages

        urlString += ".json";

        JSONObject object = (JSONObject)  restClient.get(urlString, user.getCookie());
        JSONArray array = (JSONArray) ((JSONObject) object.get("data")).get("children");

        JSONObject data;
        for (int i = 0; i < array.size(); i++) {
            data = (JSONObject) array.get(i);
            data = ((JSONObject) data.get("data"));
            submissions.add(new Submission(user, data.get("id").toString(), (data.get("permalink").toString())));
        }

        return submissions;
    } 
                            #location 27 
                            #vulnerability type NULL_DEREFERENCE