#vulnerable code 
                                public List<Category> getFriendList() {
        LOGGER.info("开始获取好友列表");
        HttpPost post = defaultHttpPost(
                "http://s.web2.qq.com/api/get_user_friends2",
                "http://s.web2.qq.com/proxy.html?v=20130916001&callback=1&id=1");
        JSONObject r = new JSONObject();
        r.put("vfwebqq", vfwebqq);
        r.put("hash", hash());
        try {
            post.setEntity(new UrlEncodedFormEntity(Arrays.asList(new BasicNameValuePair("r", r.toJSONString()))));
            try (CloseableHttpResponse response = client.execute(post, context)) {
                JSONObject responseJson = JSON.parseObject(getResponseText(response));
                if (0 == responseJson.getIntValue("retcode")) {
                    JSONObject result = responseJson.getJSONObject("result");
                    //获得分组
                    JSONArray categories = result.getJSONArray("categories");
                    Map<Integer, Category> categoryMap = new HashMap<>();
                    categoryMap.put(0, Category.defaultCategory());
                    for (int i = 0; categories != null && i < categories.size(); i++) {
                        Category category = categories.getObject(i, Category.class);
                        categoryMap.put(category.getIndex(), category);
                    }
                    //获得好友信息
                    Map<Long, Friend> friendMap = new HashMap<>();
                    JSONArray friends = result.getJSONArray("friends");
                    for (int i = 0; friends != null && i < friends.size(); i++) {
                        JSONObject item = friends.getJSONObject(i);
                        Friend friend = new Friend();
                        friend.setUserId(item.getLongValue("uin"));
                        friendMap.put(friend.getUserId(), friend);
                        categoryMap.get(item.getIntValue("categories")).addFriend(friend);
                    }
                    JSONArray marknames = result.getJSONArray("marknames");
                    for (int i = 0; marknames != null && i < marknames.size(); i++) {
                        JSONObject item = marknames.getJSONObject(i);
                        friendMap.get(item.getLongValue("uin")).setMarkname(item.getString("markname"));
                    }
                    JSONArray info = result.getJSONArray("info");
                    for (int i = 0; info != null && i < info.size(); i++) {
                        JSONObject item = info.getJSONObject(i);
                        friendMap.get(item.getLongValue("uin")).setNickname(item.getString("nick"));
                    }
                    JSONArray vipinfo = result.getJSONArray("vipinfo");
                    for (int i = 0; vipinfo != null && i < vipinfo.size(); i++) {
                        JSONObject item = vipinfo.getJSONObject(i);
                        Friend friend = friendMap.get(item.getLongValue("u"));
                        friend.setVip(item.getIntValue("is_vip") == 1);
                        friend.setVipLevel(item.getIntValue("vip_level"));
                    }
                    return new ArrayList<>(categoryMap.values());
                } else {
                    LOGGER.error("获取好友列表失败");
                }
            } catch (IOException e) {
                LOGGER.error("获取好友列表失败");
            }
        } catch (UnsupportedEncodingException e) {
            LOGGER.error("获取好友列表失败");
        }
        return Collections.EMPTY_LIST;
    } 
                            #location 31 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                public List<Category> getFriendList() {
        LOGGER.info("开始获取好友列表");
        JSONObject r = new JSONObject();
        r.put("vfwebqq", vfwebqq);
        r.put("hash", hash());
        try {
            HttpPost post = defaultHttpPost(ApiUrl.GET_FRIEND_LIST, new BasicNameValuePair("r", r.toJSONString()));
            try (CloseableHttpClient client = HttpClients.createDefault();
                 CloseableHttpResponse response = client.execute(post, context)) {
                JSONObject responseJson = JSON.parseObject(getResponseText(response));
                if (0 == responseJson.getIntValue("retcode")) {
                    JSONObject result = responseJson.getJSONObject("result");
                    //获得分组
                    JSONArray categories = result.getJSONArray("categories");
                    Map<Integer, Category> categoryMap = new HashMap<>();
                    categoryMap.put(0, Category.defaultCategory());
                    for (int i = 0; categories != null && i < categories.size(); i++) {
                        Category category = categories.getObject(i, Category.class);
                        categoryMap.put(category.getIndex(), category);
                    }
                    //获得好友信息
                    Map<Long, Friend> friendMap = new HashMap<>();
                    JSONArray friends = result.getJSONArray("friends");
                    for (int i = 0; friends != null && i < friends.size(); i++) {
                        JSONObject item = friends.getJSONObject(i);
                        Friend friend = new Friend();
                        friend.setUserId(item.getLongValue("uin"));
                        friendMap.put(friend.getUserId(), friend);
                        categoryMap.get(item.getIntValue("categories")).addFriend(friend);
                    }
                    JSONArray marknames = result.getJSONArray("marknames");
                    for (int i = 0; marknames != null && i < marknames.size(); i++) {
                        JSONObject item = marknames.getJSONObject(i);
                        friendMap.get(item.getLongValue("uin")).setMarkname(item.getString("markname"));
                    }
                    JSONArray info = result.getJSONArray("info");
                    for (int i = 0; info != null && i < info.size(); i++) {
                        JSONObject item = info.getJSONObject(i);
                        friendMap.get(item.getLongValue("uin")).setNickname(item.getString("nick"));
                    }
                    JSONArray vipinfo = result.getJSONArray("vipinfo");
                    for (int i = 0; vipinfo != null && i < vipinfo.size(); i++) {
                        JSONObject item = vipinfo.getJSONObject(i);
                        Friend friend = friendMap.get(item.getLongValue("u"));
                        friend.setVip(item.getIntValue("is_vip") == 1);
                        friend.setVipLevel(item.getIntValue("vip_level"));
                    }
                    return new ArrayList<>(categoryMap.values());
                } else {
                    LOGGER.error("获取好友列表失败");
                }
            } catch (IOException e) {
                LOGGER.error("获取好友列表失败");
            }
        } catch (UnsupportedEncodingException e) {
            LOGGER.error("获取好友列表失败");
        }
        return Collections.EMPTY_LIST;
    }