#vulnerable code 
                                @Override
    public void notify(DelegateTask delegateTask) {
        logger.info("查询部门审核人员");

        auditUserInnerServiceSMOImpl = ApplicationContextFactory.getBean("auditUserInnerServiceSMOImpl", IAuditUserInnerServiceSMO.class);
        AuditUserDto auditUserDto = new AuditUserDto();
        PurchaseApplyDto purchaseApplyDto = (PurchaseApplyDto)delegateTask.getVariable("purchaseApplyDto");
        auditUserDto.setStoreId(purchaseApplyDto.getStoreId());
        auditUserDto.setObjCode("resourceEntry");
        auditUserDto.setAuditLink("809001");
        List<AuditUserDto> auditUserDtos = auditUserInnerServiceSMOImpl.queryAuditUsers(auditUserDto);


        for (AuditUserDto tmpAuditUser : auditUserDtos) {
            AuditUser auditUser = BeanConvertUtil.covertBean(tmpAuditUser, AuditUser.class);
            logger.info("查询到用户："+tmpAuditUser.getUserName());

            delegateTask.setVariable(auditUser.getUserId(), auditUser);

        }

        logger.info("查询审核人员人数："+auditUserDtos.size());

        if (auditUserDtos == null || auditUserDtos.size() < 1) {
            return;
        }

        delegateTask.setAssignee(auditUserDtos.get(0).getUserId());
        logger.info("设置部门审核人员："+auditUserDtos.get(0).getUserId()+auditUserDtos.get(0).getUserName());
    } 
                            #location 11 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @Override
    public void notify(DelegateTask delegateTask) {
        logger.info("查询部门审核人员");

//        auditUserInnerServiceSMOImpl = ApplicationContextFactory.getBean("auditUserInnerServiceSMOImpl", IAuditUserInnerServiceSMO.class);
//        AuditUserDto auditUserDto = new AuditUserDto();
//        PurchaseApplyDto purchaseApplyDto = (PurchaseApplyDto)delegateTask.getVariable("purchaseApplyDto");
        String nextAuditStaffId = delegateTask.getVariable("nextAuditStaffId").toString();
        /*auditUserDto.setStoreId(purchaseApplyDto.getStoreId());
        auditUserDto.setObjCode("resourceEntry");
        auditUserDto.setAuditLink("809001");
        List<AuditUserDto> auditUserDtos = auditUserInnerServiceSMOImpl.queryAuditUsers(auditUserDto);


        for (AuditUserDto tmpAuditUser : auditUserDtos) {
            AuditUser auditUser = BeanConvertUtil.covertBean(tmpAuditUser, AuditUser.class);
            logger.info("查询到用户："+tmpAuditUser.getUserName());

            delegateTask.setVariable(auditUser.getUserId(), auditUser);

        }

        logger.info("查询审核人员人数："+auditUserDtos.size());

        if (auditUserDtos == null || auditUserDtos.size() < 1) {
            return;
        }*/

        delegateTask.setAssignee(nextAuditStaffId);
        logger.info("设置部门审核人员："+nextAuditStaffId);
    }