#vulnerable code 
                                public static void bindPrincipalsToSessionIfNecessary( HttpServletRequest request ) {
        SecurityContext ctx = (SecurityContext) ThreadContext.get( ThreadContext.SECURITY_CONTEXT_KEY );

        if ( ctx != null ) {
            Session session = ThreadLocalSecurityContext.current().getSession( false );
            if( session != null && session.getAttribute( PRINCIPALS_SESSION_KEY) == null ) {
                session.setAttribute( PRINCIPALS_SESSION_KEY, ctx.getAllPrincipals() );

            } else {
                HttpSession httpSession = request.getSession();
                if( httpSession.getAttribute( PRINCIPALS_SESSION_KEY ) == null ) {
                    httpSession.setAttribute( PRINCIPALS_SESSION_KEY, ctx.getAllPrincipals() );
                }
            }
        }
    } 
                            #location 5 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                public static void bindPrincipalsToSessionIfNecessary( HttpServletRequest request ) {
        SecurityContext ctx = (SecurityContext) ThreadContext.get( ThreadContext.SECURITY_CONTEXT_KEY );

        if ( ctx != null ) {
            Session session = ThreadLocalSecurityContext.current().getSession();
            if( session != null && session.getAttribute( PRINCIPALS_SESSION_KEY) == null ) {
                session.setAttribute( PRINCIPALS_SESSION_KEY, ctx.getAllPrincipals() );

            } else {
                HttpSession httpSession = request.getSession();
                if( httpSession.getAttribute( PRINCIPALS_SESSION_KEY ) == null ) {
                    httpSession.setAttribute( PRINCIPALS_SESSION_KEY, ctx.getAllPrincipals() );
                }
            }
        }
    }