#vulnerable code 
                                @Test
    public void testSession_whenCreateIsTrue() {

        when(servletRequest.getSession(true)).thenReturn(httpSession);

        Request request = new Request(match, servletRequest);

        assertEquals("A Session with an HTTPSession from the Request should have been created because create parameter " +
                        "was set to true",
                httpSession, request.session(true).raw());

    } 
                            #location 10 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @Test
    public void testSession_whenCreateIsTrue() {

        when(servletRequest.getSession(true)).thenReturn(httpSession);

        assertEquals("A Session with an HTTPSession from the Request should have been created because create parameter " +
                        "was set to true",
                httpSession, request.session(true).raw());

    }