#vulnerable code 
                                protected boolean bindInHttpSessionForSubsequentRequests( HttpServletRequest request, HttpServletResponse response,
                                                              SecurityContext securityContext ) {
        HttpSession httpSession = request.getSession();
        Object currentPrincipal = httpSession.getAttribute(PRINCIPALS_SESSION_KEY);
        if ( currentPrincipal == null && !securityContext.getAllPrincipals().isEmpty()  ) {
            httpSession.setAttribute( PRINCIPALS_SESSION_KEY, securityContext.getAllPrincipals() );
        }
        Boolean currentAuthenticated = (Boolean) httpSession.getAttribute( AUTHENTICATED_SESSION_KEY );
        if ( !currentAuthenticated.equals( securityContext.isAuthenticated() ) ) {
            httpSession.setAttribute( AUTHENTICATED_SESSION_KEY, securityContext.getAllPrincipals() );
        }
        return true;
    } 
                            #location 9 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                protected boolean bindInHttpSessionForSubsequentRequests( HttpServletRequest request, HttpServletResponse response,
                                                              SecurityContext securityContext ) {
        HttpSession httpSession = request.getSession();

        // Don't overwrite any previous credentials - i.e. SecurityContext swapping for a previously
        // initialized session is not allowed.
        // Only store principals if they exist in the security context
        Object currentPrincipal = httpSession.getAttribute(PRINCIPALS_SESSION_KEY);
        if ( currentPrincipal == null && !securityContext.getAllPrincipals().isEmpty()  ) {
            httpSession.setAttribute( PRINCIPALS_SESSION_KEY, securityContext.getAllPrincipals() );
        }

        // Only bind if the current value in the session is null or it doesn't equal the security context value
        Boolean currentAuthenticated = (Boolean) httpSession.getAttribute( AUTHENTICATED_SESSION_KEY );
        if ( currentAuthenticated == null || !currentAuthenticated.equals( securityContext.isAuthenticated() ) ) {
            httpSession.setAttribute( AUTHENTICATED_SESSION_KEY, securityContext.isAuthenticated() );
        }
        return true;
    }