#vulnerable code 
                             @PreAuthorize("isAuthenticated()")
	public String fetchNewToken(Optional<Long> expirationMillis,
			Optional<String> optionalUsername) {
		
		SpringUser<ID> springUser = LemonUtils.getSpringUser();
		String username = optionalUsername.orElse(springUser.getUsername());
		
		LemonUtils.ensureAuthority(springUser.getUsername().equals(username) ||
				springUser.isGoodAdmin(), "com.naturalprogrammer.spring.notGoodAdminOrSameUser");
		
		return LemonSecurityConfig.TOKEN_PREFIX +
				jwtService.createToken(JwtService.AUTH_AUDIENCE, username,
				expirationMillis.orElse(properties.getJwt().getExpirationMillis()));
	} 
                            #location 6 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             @PreAuthorize("isAuthenticated()")
	public String fetchNewToken(Optional<Long> expirationMillis,
			Optional<String> optionalUsername) {
		
		UserDto<ID> currentUser = LemonUtils.currentUser();
		String username = optionalUsername.orElse(currentUser.getUsername());
		
		LemonUtils.ensureAuthority(currentUser.getUsername().equals(username) ||
				currentUser.isGoodAdmin(), "com.naturalprogrammer.spring.notGoodAdminOrSameUser");
		
		return LemonSecurityConfig.TOKEN_PREFIX +
				jwtService.createToken(JwtService.AUTH_AUDIENCE, username,
				expirationMillis.orElse(properties.getJwt().getExpirationMillis()));
	}