#vulnerable code 
                                @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, HandlerMethod handler, ModelAndView modelAndView) throws Exception {
        PostVO ret = (PostVO) modelAndView.getModelMap().get("view");
        Object editing = modelAndView.getModel().get("editing");
        if (null == editing && ret != null) {
            PostVO post = new PostVO();
            BeanUtils.copyProperties(ret, post);
            if (check(ret.getId(), ret.getAuthor().getId())) {
                post.setContent(replace(post.getContent()));
            } else {
                String c = post.getContent().replaceAll("&lt;hide&gt;", "<hide>");
                c = c.replaceAll("&lt;/hide&gt;", "</hide>");
                post.setContent(c);
            }
            modelAndView.getModelMap().put("view", post);
        }
    } 
                            #location 9 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, HandlerMethod handler, ModelAndView modelAndView) throws Exception {
        PostVO ret = (PostVO) modelAndView.getModelMap().get("view");
        Object editing = modelAndView.getModel().get("editing");
        if (null == editing && ret != null) {
            PostVO post = new PostVO();
            BeanUtils.copyProperties(ret, post);
            if (check(ret.getId(), ret.getAuthor().getId())) {
                String c = post.getContent().replaceAll("\\[hide\\]([\\s\\S]*)\\[\\/hide\\]", SHOW);
                post.setContent(c);
            } else {
                String c = post.getContent().replaceAll("\\[hide\\]([\\s\\S]*)\\[\\/hide\\]", "$1");
                post.setContent(c);
            }
            modelAndView.getModelMap().put("view", post);
        }
    }