#vulnerable code 
                              static void whitelistVerify(
      final String remoteHost,
      final WhitelistItem whitelistItem,
      final Map<String, List<String>> headers,
      final String postContent)
      throws WhitelistException {

    String whitelistHost = whitelistItem.getHost();

    if (HostVerifier.whitelistContains(remoteHost, whitelistHost)) {
      if (whitelistItem.isHmacEnabled()) {
        final Optional<StringCredentials> hmacKeyOpt =
            CredentialsHelper.findCredentials(whitelistItem.getHmacCredentialId());
        if (!hmacKeyOpt.isPresent()) {
          throw new WhitelistException(
              "Was unable to find secret text credential " + whitelistItem.getHmacCredentialId());
        }
        final String hmacHeader = whitelistItem.getHmacHeader();
        final String hmacKey = hmacKeyOpt.get().getSecret().getPlainText();
        final String hmacAlgorithm = whitelistItem.getHmacAlgorithm();
        hmacVerify(headers, postContent, hmacHeader, hmacKey, hmacAlgorithm);
        return;
      }
      return;
    }
    throw new WhitelistException(
        "Sending host \"" + remoteHost + "\" was not matched by whitelist.");
  } 
                            #location 10 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                              static void whitelistVerify(
      final String remoteHost,
      final WhitelistItem whitelistItem,
      final Map<String, List<String>> headers,
      final String postContent)
      throws WhitelistException {

    WhitelistHost whitelistHost = new WhitelistHost(whitelistItem.getHost());

    if (HostVerifier.whitelistVerified(new WhitelistHost(remoteHost), whitelistHost)) {
      if (whitelistItem.isHmacEnabled()) {
        final Optional<StringCredentials> hmacKeyOpt =
            CredentialsHelper.findCredentials(whitelistItem.getHmacCredentialId());
        if (!hmacKeyOpt.isPresent()) {
          throw new WhitelistException(
              "Was unable to find secret text credential " + whitelistItem.getHmacCredentialId());
        }
        final String hmacHeader = whitelistItem.getHmacHeader();
        final String hmacKey = hmacKeyOpt.get().getSecret().getPlainText();
        final String hmacAlgorithm = whitelistItem.getHmacAlgorithm();
        hmacVerify(headers, postContent, hmacHeader, hmacKey, hmacAlgorithm);
        return;
      }
      return;
    }
    throw new WhitelistException(
        "Sending host \"" + remoteHost + "\" was not matched by whitelist.");
  }