#vulnerable code 
                                public String getHTTPBasicCredentials(IHttpRequestResponse messageInfo) throws Exception{
        String authHeader  = getHeaderValueOf(true, messageInfo, "Authorization").trim(); 
        String[] parts = authHeader.split("\\s");
        
        if (parts.length != 2)
            throw new Exception("Wrong number of HTTP Authorization header parts");

        if (!parts[0].equalsIgnoreCase("Basic"))
            throw new Exception("HTTP authentication must be Basic");

        return parts[1]; 
    } 
                            #location 2 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             public String getHTTPBasicCredentials(IHttpRequestResponse messageInfo) throws Exception{
		String authHeader  = getHeaderValueOf(true, messageInfo, "Authorization").trim();
		String[] parts = authHeader.split("\\s");

		if (parts.length != 2)
			throw new Exception("Wrong number of HTTP Authorization header parts");

		if (!parts[0].equalsIgnoreCase("Basic"))
			throw new Exception("HTTP authentication must be Basic");

		return parts[1];
	}