#vulnerable code 
                              public static <T> List<T> queryColumnListSQL(String poolName, String sql, String columnName, Class<T> type, Object[] params) {

    List<T> returnList = null;

    Connection con = null;

    try {
      con = DB_CONNECTION_MANAGER.getConnection(poolName);

      if (con == null) {
        throw new ConnectionException(poolName);
      }

      con.setAutoCommit(false);

      ColumnListHandler<T> resultSetHandler = new ColumnListHandler<T>(columnName);

      returnList = new QueryRunner().query(con, sql, resultSetHandler, params);

      con.commit();

    } catch (Exception e) {
      logger.error(QUERY_EXCEPTION_MESSAGE, e);
      try {
        con.rollback();
      } catch (SQLException e2) {
        logger.error(ROLLBACK_EXCEPTION_MESSAGE, e2);
      }
    } finally {
      DB_CONNECTION_MANAGER.freeConnection(con);
    }

    return returnList;
  } 
                            #location 25 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                              public static <T> List<T> queryColumnListSQL(String poolName, String sql, String columnName, Class<T> type, Object[] params) {

    List<T> returnList = null;

    try {

      ColumnListHandler<T> resultSetHandler = new ColumnListHandler<T>(columnName);

      returnList = new QueryRunner(DB_CONNECTION_MANAGER.getDataSource(poolName)).query(sql, resultSetHandler, params);

    } catch (Exception e) {
      logger.error(QUERY_EXCEPTION_MESSAGE, e);
    }

    return returnList;
  }