#vulnerable code 
                                @Test
    public void testGetAzureTokenCredentials() throws Exception {
        // 1. use azure-secret.json
        File testConfigDir = new File(this.getClass().getResource("/azure-login/azure-secret.json").getFile()).getParentFile();
        TestHelper.injectEnvironmentVariable(Constants.AZURE_CONFIG_DIR, testConfigDir.getAbsolutePath());
        AzureTokenCredentials cred = AzureAuthHelper.getAzureTokenCredentials(null);
        assertNotNull(cred);
        assertEquals("00000000-0000-0000-0000-000000000001", cred.defaultSubscriptionId());

        // 2. use azure cli(non SP)
        testConfigDir = new File(this.getClass().getResource("/azure-cli/default/azureProfile.json").getFile()).getParentFile();
        TestHelper.injectEnvironmentVariable(Constants.AZURE_CONFIG_DIR, testConfigDir.getAbsolutePath());
        cred = AzureAuthHelper.getAzureTokenCredentials(null);
        assertNotNull(cred);
        assertTrue(cred instanceof AzureCliCredentials);
        final AzureCliCredentials cliCred = (AzureCliCredentials) cred;
        assertEquals("00000000-0000-0000-0000-000000000001", cliCred.defaultSubscriptionId());
        assertEquals("00000000-0000-0000-0000-000000000002", cliCred.clientId());
        assertEquals("00000000-0000-0000-0000-000000000003", cliCred.domain());
        assertEquals(AzureEnvironment.AZURE_CHINA, cliCred.environment());

        // 3. use azure cli(SP)
        testConfigDir = new File(this.getClass().getResource("/azure-cli/sp/azureProfile.json").getFile()).getParentFile();
        TestHelper.injectEnvironmentVariable(Constants.AZURE_CONFIG_DIR, testConfigDir.getAbsolutePath());
        cred = AzureAuthHelper.getAzureTokenCredentials(null);
        assertNotNull(cred);
        assertTrue(cred instanceof AzureCliCredentials);
        final AzureCliCredentials azureCliCredential = (AzureCliCredentials) cred;
        assertEquals("00000000-0000-0000-0000-000000000001", cred.defaultSubscriptionId());
        assertEquals("00000000-0000-0000-0000-000000000002", azureCliCredential.clientId());
        assertEquals("00000000-0000-0000-0000-000000000003", cred.domain());
        assertEquals(AzureEnvironment.AZURE_CHINA, cliCred.environment());

        // 4. use cloud shell
        TestHelper.injectEnvironmentVariable(Constants.CLOUD_SHELL_ENV_KEY, "azure");
        assertTrue(AzureAuthHelper.isInCloudShell());
        TestHelper.injectEnvironmentVariable(Constants.AZURE_CONFIG_DIR, "non-exist-folder");
        cred = AzureAuthHelper.getAzureTokenCredentials(null);
        assertNotNull(cred);
        assertTrue(cred instanceof MSICredentials);

        // 5. all of the ways have been tried
        TestHelper.injectEnvironmentVariable(Constants.CLOUD_SHELL_ENV_KEY, null);
        assertNull(AzureAuthHelper.getAzureTokenCredentials(null));
    } 
                            #location 17 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @Test
    public void testGetAzureTokenCredentials() throws Exception {
        // 1. use azure-secret.json
        File testConfigDir = new File(this.getClass().getResource("/azure-login/azure-secret.json").getFile()).getParentFile();
        TestHelper.injectEnvironmentVariable(Constants.AZURE_CONFIG_DIR, testConfigDir.getAbsolutePath());
        AzureTokenCredentials cred = AzureAuthHelper.getAzureTokenCredentials(null);
        assertNotNull(cred);
        assertEquals("00000000-0000-0000-0000-000000000001", cred.defaultSubscriptionId());

        // 2. use azure cli(non SP)
        testConfigDir = new File(this.getClass().getResource("/azure-cli/default/azureProfile.json").getFile()).getParentFile();
        TestHelper.injectEnvironmentVariable(Constants.AZURE_CONFIG_DIR, testConfigDir.getAbsolutePath());
        cred = AzureAuthHelper.getAzureTokenCredentials(null).getAzureTokenCredentials();
        assertNotNull(cred);
        assertTrue(cred instanceof AzureCliCredentials);
        final AzureCliCredentials cliCred = (AzureCliCredentials) cred;
        assertEquals("00000000-0000-0000-0000-000000000001", cliCred.defaultSubscriptionId());
        assertEquals("00000000-0000-0000-0000-000000000002", cliCred.clientId());
        assertEquals("00000000-0000-0000-0000-000000000003", cliCred.domain());
        assertEquals(AzureEnvironment.AZURE_CHINA, cliCred.environment());

        // 3. use azure cli(SP)
        testConfigDir = new File(this.getClass().getResource("/azure-cli/sp/azureProfile.json").getFile()).getParentFile();
        TestHelper.injectEnvironmentVariable(Constants.AZURE_CONFIG_DIR, testConfigDir.getAbsolutePath());
        cred = AzureAuthHelper.getAzureTokenCredentials(null).getAzureTokenCredentials();
        assertNotNull(cred);
        assertTrue(cred instanceof AzureCliCredentials);
        final AzureCliCredentials azureCliCredential = (AzureCliCredentials) cred;
        assertEquals("00000000-0000-0000-0000-000000000001", cred.defaultSubscriptionId());
        assertEquals("00000000-0000-0000-0000-000000000002", azureCliCredential.clientId());
        assertEquals("00000000-0000-0000-0000-000000000003", cred.domain());
        assertEquals(AzureEnvironment.AZURE_CHINA, cliCred.environment());

        // 4. use cloud shell
        TestHelper.injectEnvironmentVariable(Constants.CLOUD_SHELL_ENV_KEY, "azure");
        assertTrue(AzureAuthHelper.isInCloudShell());
        TestHelper.injectEnvironmentVariable(Constants.AZURE_CONFIG_DIR, "non-exist-folder");
        cred = AzureAuthHelper.getAzureTokenCredentials(null).getAzureTokenCredentials();
        assertNotNull(cred);
        assertTrue(cred instanceof MSICredentials);

        // 5. all of the ways have been tried
        TestHelper.injectEnvironmentVariable(Constants.CLOUD_SHELL_ENV_KEY, null);
        assertNull(AzureAuthHelper.getAzureTokenCredentials(null));
    }