#vulnerable code 
                              public void testReturnDelegateCookies() {
    Cookie[] cookies = new Cookie[]{
        new Cookie("testName1", TEST_VALUE_1),
        new Cookie("testName2", "testValue2")
    };
    HttpServletRequest delegate = createMock(HttpServletRequest.class);
    expect(delegate.getCookies()).andStubReturn(cookies);

    replay(delegate);

    ContinuingHttpServletRequest continuingRequest = new ContinuingHttpServletRequest(
        delegate);

    assertCookieArraysEqual(cookies, continuingRequest.getCookies());

    // Now mutate the original cookies, this shouldnt be reflected in the continued request.
    cookies[0].setValue("INVALID");
    cookies[1].setValue("INVALID");
    cookies[1].setMaxAge(123);

    try {
      assertCookieArraysEqual(cookies, continuingRequest.getCookies());
      fail();
    } catch (AssertionFailedError e) {
      // Expected.
    }

    // Verify that they remain equal to the original values.
    assertEquals(TEST_VALUE_1, continuingRequest.getCookies()[0].getValue());
    assertEquals(TEST_VALUE_2, continuingRequest.getCookies()[1].getValue());
    assertEquals(DEFAULT_MAX_AGE, continuingRequest.getCookies()[1].getMaxAge());

    // Perform a snapshot of the snapshot.
    ContinuingHttpServletRequest furtherContinuingRequest = new ContinuingHttpServletRequest(
        continuingRequest);

    // The cookies should be fixed.
    assertCookieArraysEqual(continuingRequest.getCookies(), furtherContinuingRequest.getCookies());

    verify(delegate);
  } 
                            #location 29 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                              public void testReturnDelegateCookies() {
    Cookie[] cookies = new Cookie[]{
        new Cookie("testName1", TEST_VALUE_1),
        new Cookie("testName2", "testValue2")
    };
    HttpServletRequest delegate = createMock(HttpServletRequest.class);
    expect(delegate.getCookies()).andStubReturn(cookies);

    replay(delegate);

    ContinuingHttpServletRequest continuingRequest = new ContinuingHttpServletRequest(
        delegate);

    assertCookieArraysEqual(cookies, continuingRequest.getCookies());

    // Now mutate the original cookies, this shouldnt be reflected in the continued request.
    cookies[0].setValue("INVALID");
    cookies[1].setValue("INVALID");
    cookies[1].setMaxAge(123);

    try {
      assertCookieArraysEqual(cookies, continuingRequest.getCookies());
      throw new Error();
    } catch (AssertionFailedError e) {
      // Expected.
    }

    // Verify that they remain equal to the original values.
    assertEquals(TEST_VALUE_1, continuingRequest.getCookies()[0].getValue());
    assertEquals(TEST_VALUE_2, continuingRequest.getCookies()[1].getValue());
    assertEquals(DEFAULT_MAX_AGE, continuingRequest.getCookies()[1].getMaxAge());

    // Perform a snapshot of the snapshot.
    ContinuingHttpServletRequest furtherContinuingRequest = new ContinuingHttpServletRequest(
        continuingRequest);

    // The cookies should be fixed.
    assertCookieArraysEqual(continuingRequest.getCookies(), furtherContinuingRequest.getCookies());

    verify(delegate);
  }