#fixed code
                             @RequestMapping(value = "/{id}", method = RequestMethod.GET)
	@ResponseBody
	public UserDTO getUser(@PathVariable("id") Long id) {
		User user = accountService.getUser(id);

		if (user == null) {
			String message = "用户不存在(id:" + id + ")";
			logger.warn(message);
			throw new RestException(HttpStatus.NOT_FOUND, message);
		}

		// 使用Dozer转换DTO类，并补充Dozer不能自动绑定的属性
		UserDTO dto = BeanMapper.map(user, UserDTO.class);
		dto.setTeamId(user.getTeam().getId());
		return dto;
	}
#vulnerable code 
                             @RequestMapping(value = "/{id}", method = RequestMethod.GET)
	@ResponseBody
	public UserDTO getUser(@PathVariable("id") Long id) {
		User user = accountService.getUser(id);

		// 使用Dozer转换DTO类，并补充Dozer不能自动绑定的属性
		UserDTO dto = BeanMapper.map(user, UserDTO.class);
		dto.setTeamId(user.getTeam().getId());
		return dto;
	} 
                            #location 8 
                            #vulnerability type NULL_DEREFERENCE