#fixed code
                                public int onDoStartTag() throws JspException {
        String strValue = null;

        if( getSecurityContext() != null && getSecurityContext().isAuthenticated() ) {

            // Get the principal to print out
            Principal principal;
            if( type == null ) {
                principal = getSecurityContext().getPrincipal();
            } else {
                principal = getSecurityContext().getPrincipalByType( type );
            }

            // Get the string value of the principal
            if( principal != null ) {
                if( property == null ) {
                    strValue = principal.toString();
                } else {
                    strValue = getPrincipalProperty( principal, property );
                }
            }

        }

        // Print out the principal value if not null
        if( strValue != null ) {
            try {
                pageContext.getOut().write( strValue );
            } catch (IOException e) {
                throw new JspTagException( "Error writing [" + strValue + "] to JSP.", e );
            }
        }

        return SKIP_BODY;
    }
#vulnerable code 
                                public int onDoStartTag() throws JspException {
        String strValue = null;

        if( getSecurityContext().isAuthenticated() ) {

            // Get the principal to print out
            Principal principal;
            if( type == null ) {
                principal = getSecurityContext().getPrincipal();
            } else {
                principal = getSecurityContext().getPrincipalByType( type );
            }

            // Get the string value of the principal
            if( principal != null ) {
                if( property == null ) {
                    strValue = principal.toString();
                } else {
                    strValue = getPrincipalProperty( principal, property );
                }
            }

        }

        // Print out the principal value if not null
        if( strValue != null ) {
            try {
                pageContext.getOut().write( strValue );
            } catch (IOException e) {
                throw new JspTagException( "Error writing [" + strValue + "] to JSP.", e );
            }
        }

        return SKIP_BODY;
    } 
                            #location 4 
                            #vulnerability type NULL_DEREFERENCE