#vulnerable code 
                                public static String sanitizeBaseUrl(final String baseUriSpec, final String uriSpec) {
        if (baseUriSpec == null) {
            return null;
        }

        URI baseUri = URI.create(baseUriSpec);

        try {
            String fixedBaseUriSpec = baseUriSpec;
            if (baseUri.getScheme() == null) {
                while (!fixedBaseUriSpec.startsWith("//")) {
                    fixedBaseUriSpec = "/" + fixedBaseUriSpec;
                }
                baseUri = new URIBuilder(fixedBaseUriSpec).setScheme("http").build();
            }

            URI uri = uriSpec == null ? null : URI.create(uriSpec);
            String scheme = uri == null || !baseUri.getAuthority().equals(uri.getAuthority()) ? baseUri.getScheme() : uri.getScheme();

            if (!scheme.equals(baseUri.getScheme())) {
                return new URIBuilder(baseUri).setScheme(scheme).build().toString();
            }
        } catch (final URISyntaxException e) {
            throw new IllegalArgumentException(e.getMessage(), e);
        }

        return baseUri.toString();
    } 
                            #location 20 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                public static String sanitizeBaseUrl(final String baseUriSpec, final String uriSpec) {
        if (baseUriSpec == null) {
            return null;
        }

        URI baseUri = URI.create(baseUriSpec);

        try {
            baseUri = ensureScheme(baseUri, "http");

            final URI uri = uriSpec == null ? null : URI.create(uriSpec);
            final String scheme = uri == null || !Objects.equals(baseUri.getAuthority(), uri.getAuthority()) || !Arrays
                    .asList(new String[] {"http", "https"}).contains(uri.getScheme()) ? baseUri.getScheme() : uri.getScheme();

            if (!scheme.equals(baseUri.getScheme())) {
                return new URIBuilder(baseUri).setScheme(scheme).build().toString();
            }
        } catch (final URISyntaxException e) {
            throw new IllegalArgumentException(e.getMessage(), e);
        }

        return baseUri.toString();
    }