#vulnerable code 
                             public U fetchUser(@Valid @Email @NotNull String email) {
		
		SaUser loggedIn = SaUtil.getSessionUser();

		U user = userRepository.findByEmail(email);
		
		if (user == null) {
			////////////////// throw SaFormException
		}

		user.setPassword(null);
		
		if (loggedIn == null ||	loggedIn.getId() != user.getId() && !loggedIn.isAdmin())
				user.setEmail("Confidential");
		
		return user;
	} 
                            #location 11 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             public U fetchUser(@Valid @Email @NotNull String email) {
		
		SaUser loggedIn = SaUtil.getSessionUser();

		U user = userRepository.findByEmail(email);
		
		if (user == null) {
			throw new FormException("email", "userNotFound");
		}

		user.setPassword(null);
		
		if (loggedIn == null ||	loggedIn.getId() != user.getId() && !loggedIn.isAdmin())
				user.setEmail("Confidential");
		
		return user;
	}