#vulnerable code 
                                @SuppressWarnings( "unchecked" )
    private static List<Principal> getPrincipals(HttpServletRequest request) {
        List<Principal> principals = null;

        Session session = ThreadLocalSecurityContext.current().getSession( false );
        if( session != null ) {
            principals = (List<Principal>) session.getAttribute( PRINCIPALS_SESSION_KEY );
        } else {
            HttpSession httpSession = request.getSession( false );
            if( httpSession != null ) {
                principals =  (List<Principal>) httpSession.getAttribute( PRINCIPALS_SESSION_KEY );
            }
        }
        return principals;
    } 
                            #location 5 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @SuppressWarnings( "unchecked" )
    private static List<Principal> getPrincipals(HttpServletRequest request) {
        List<Principal> principals = null;

        Session session = (Session) ThreadContext.get( ThreadContext.SESSION_KEY );
        if( session != null ) {
            principals = (List<Principal>) session.getAttribute( PRINCIPALS_SESSION_KEY );
        } else {
            HttpSession httpSession = request.getSession( false );
            if( httpSession != null ) {
                principals =  (List<Principal>) httpSession.getAttribute( PRINCIPALS_SESSION_KEY );
            }
        }
        return principals;
    }