#vulnerable code 
                             public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
            Authentication authentication) throws IOException, ServletException {

        // instead of this, the statement below is introduced: handle(request, response, authentication);
    	response.setStatus(HttpServletResponse.SC_OK);
    	response.getOutputStream().print(objectMapper.writeValueAsString(SaUtil.getLoggedInUser().getUserDto()));
        clearAuthenticationAttributes(request);
        log.info("AuthenticationSuccess: " + SaUtil.getLoggedInUser().getUserDto());
        
    } 
                            #location 8 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
            Authentication authentication) throws IOException, ServletException {

        // instead of this, the statement below is introduced: handle(request, response, authentication);
    	response.setStatus(HttpServletResponse.SC_OK);
    	response.getOutputStream().print(objectMapper.writeValueAsString(SaUtil.getBean(SaService.class).userForClient()));
        clearAuthenticationAttributes(request);
        //log.info("AuthenticationSuccess: " + SaUtil.getLoggedInUser());
        
    }