#vulnerable code 
                             @OnOpen
	public void open(Session session, @PathParam("channel") String channel) {
		BeanManager.INSTANCE.getReference(PushContextImpl.class).add(session, channel); // @Inject in @ServerEndpoint doesn't work in Tomcat+Weld.
	} 
                            #location 3 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             @OnOpen
	public void open(Session session, @PathParam("channel") String channel) {
		BeanManager.INSTANCE.getReference(SocketPushContext.class).add(session, channel); // @Inject in @ServerEndpoint doesn't work in Tomcat+Weld.
	}