#vulnerable code 
                                public RemoteInvocation createRemoteInvocation(MethodInvocation methodInvocation) {
        Session session = ThreadLocalSecurityContext.current().getSession( false );

        Serializable sessionId;
        if( session != null ) {
            sessionId = session.getSessionId();
        } else {
            sessionId = UUID.fromString( System.getProperty( "jsecurity.session.id" ) );
        }

        if( sessionId != null ) {
            return new SecureRemoteInvocation( methodInvocation, sessionId );
        } else {
            return super.createRemoteInvocation( methodInvocation );
        }

    } 
                            #location 2 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                public RemoteInvocation createRemoteInvocation(MethodInvocation methodInvocation) {
        Session session = (Session) ThreadContext.get( ThreadContext.SESSION_KEY );

        Serializable sessionId;
        if( session != null ) {
            sessionId = session.getSessionId();
        } else {
            sessionId = UUID.fromString( System.getProperty( "jsecurity.session.id" ) );
        }

        if( sessionId != null ) {
            return new SecureRemoteInvocation( methodInvocation, sessionId );
        } else {
            return super.createRemoteInvocation( methodInvocation );
        }

    }