#vulnerable code 
                             @PreAuthorize("hasPermission(#user, 'edit')")
	@Validated(BaseUser.UpdateValidation.class)
	@Transactional(propagation=Propagation.REQUIRED, readOnly=false)
	public U updateUser(U user, @Valid U updatedUser) {
		
		SaUtil.validate(user != null, "userNotFound");
		user.setName(updatedUser.getName());
		
		if (user.isRolesEditable()) {
			
			Set<String> roles = user.getRoles();
			
			if (updatedUser.isUnverified())
				roles.add(Role.UNVERIFIED);
			else
				roles.remove(Role.UNVERIFIED);
			
			if (updatedUser.isAdmin())
				roles.add(Role.ADMIN);
			else
				roles.remove(Role.ADMIN);
			
			if (updatedUser.isBlocked())
				roles.add(Role.BLOCKED);
			else
				roles.remove(Role.BLOCKED);
		}
		//user.setVersion(updatedUser.getVersion());
		userRepository.save(user);
		
		U loggedIn = SaUtil.getLoggedInUser();
		if (loggedIn.equals(user)) {
			loggedIn.setName(user.getName());
			loggedIn.setRoles(user.getRoles());
		}
		
		return userForClient(loggedIn);
		
	} 
                            #location 32 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             @PreAuthorize("hasPermission(#user, 'edit')")
	@Validated(BaseUser.UpdateValidation.class)
	@Transactional(propagation=Propagation.REQUIRED, readOnly=false)
	public U updateUser(U user, @Valid U updatedUser) {
		
		SaUtil.validate(user != null, "userNotFound");
		SaUtil.validateVersion(user, updatedUser);

		U loggedIn = SaUtil.getLoggedInUser();

		updateUserFields(user, updatedUser, loggedIn);
		
		userRepository.save(user);		
		return userForClient(loggedIn);
		
	}