#vulnerable code 
                             @Override
	public <T> Iterable<T> map(Class<T> type, Response<RestModel> response) {
		//TODO refactor to decouple from the REST response format
		RestStatisticsModel restStatisticsModel = new RestStatisticsModel();
		RestModel model;
		Collection<Map<String, Object>> result = new ArrayList<>();
		String[] columns = response.columns();
		Map<Long, String> relationshipEntityColumns = new HashMap<>();
		model = response.next();
		restStatisticsModel.setStatistics(model.getStats());
		while (model.getValues() != null) {
			List<RelationshipModel> relationshipModels = new ArrayList<>();
			Map<String, Object> row = new HashMap<>();
			for (int i = 0; i < columns.length; i++) {
				String column = columns[i];
				Object value = model.getValues()[i];
				if (value instanceof List) {
					List entityList = (List) value;
					//If the entities in this list aren't mappable, then just add the entity directly to the resultset
					if (isMappable(entityList)) {
						List<Object> rowVals = new ArrayList<>();
						for (Object entityObj : entityList) {
							Object mapped = map(relationshipModels, relationshipEntityColumns, column, value, entityObj);
							if (mapped != null) {
								rowVals.add(mapped);
							}
						}
						row.put(column, rowVals);
					}
					else {
						Class arrayClass = null;
						for (Object element : entityList) {
							Class clazz = element.getClass();
							if (arrayClass == null) {
								arrayClass = clazz;
							}
							else {
								if (arrayClass != clazz) {
									arrayClass = null;
									break;
								}
							}
						}
						if (arrayClass == null) {
							row.put(column,entityList.toArray());
						}
						else {
							Object array = Array.newInstance(arrayClass, entityList.size());
							for (int j = 0; j < entityList.size(); j++) {
								Array.set(array, j, Utils.coerceTypes(arrayClass, entityList.get(j)));
							}
							row.put(column, array);
						}
						//row.put(column, value);
					}
				} else {
					Object mapped = map(relationshipModels, relationshipEntityColumns, column, value, value);
					row.put(column, mapped);
				}
			}

			//Map all relationships
			DefaultGraphModel graphModel = new DefaultGraphModel();
			graphModel.setRelationships(relationshipModels.toArray(new RelationshipModel[relationshipModels.size()]));
			Map<Long, Object> relationshipEntities = graphEntityMapper.mapRelationships(graphModel);
			for (Map.Entry<Long, Object> entry : relationshipEntities.entrySet()) {
				if ((row.get(relationshipEntityColumns.get(entry.getKey())) instanceof List)) {
					((List) row.get(relationshipEntityColumns.get(entry.getKey()))).add(entry.getValue());
				} else {
					row.put(relationshipEntityColumns.get(entry.getKey()), entry.getValue());
				}
			}

			result.add(row);
			model = response.next();
		}
		restStatisticsModel.setResult(result);
		return (Iterable<T>) Arrays.asList(restStatisticsModel);
	} 
                            #location 68 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             @Override
	public <T> Iterable<T> map(Class<T> type, Response<RestModel> response) {
		RestStatisticsModel restStatisticsModel = new RestStatisticsModel();
		RestModel model = response.next();
		Collection<Map<String, Object>> result = new ArrayList<>();
		Map<Long, String> relationshipEntityColumns = new HashMap<>(); //Relationship ID to column name

		restStatisticsModel.setStatistics(model.getStats());

		while (model.getRow().entrySet().size() > 0) {
			Map<String,Object> row = model.getRow();
			List<RelationshipModel> relationshipModels = new ArrayList<>();
			for (Map.Entry<String,Object> entry : row.entrySet()) {
				Object value = entry.getValue();
				if (value instanceof List) {
					List entityList = (List) value;
					if (isMappable(entityList)) {
						for (int i=0; i< entityList.size(); i++) {
							Object mapped = mapEntity(entry.getKey(), entityList.get(i), relationshipModels, relationshipEntityColumns);
							if (mapped != null) { //if null, it'll be a relationship, which we're mapping after all nodes
								entityList.set(i, mapped);
							}
						}
					}
					else {
						convertListValueToArray(entityList, entry);
					}
				}
				else {
					if (isMappable(Arrays.asList(value))) {
						Object mapped = mapEntity(entry.getKey(), value, relationshipModels, relationshipEntityColumns);
						if (mapped != null) {
							entry.setValue(mapped);
						}
					}
				}

			}
			//Map all relationships
			DefaultGraphModel graphModel = new DefaultGraphModel();
			graphModel.setRelationships(relationshipModels.toArray(new RelationshipModel[relationshipModels.size()]));
			Map<Long, Object> relationshipEntities = graphEntityMapper.mapRelationships(graphModel);
			for (Map.Entry<Long, Object> entry : relationshipEntities.entrySet()) {
				Object rels = row.get(relationshipEntityColumns.get(entry.getKey()));
				if (rels instanceof List) {
					List relsList = (List)rels;
					for (int i=0;i<relsList.size(); i++) {
						if (relsList.get(i) instanceof RelationshipModel) {
							if (((RelationshipModel) relsList.get(i)).getId().equals(entry.getKey())) {
								relsList.set(i, entry.getValue());
							}
						}
					}
				} else {
					row.put(relationshipEntityColumns.get(entry.getKey()), entry.getValue());
				}
			}


			result.add(row);
			model = response.next();
		}
		restStatisticsModel.setResult(result);
		return (Iterable<T>) Arrays.asList(restStatisticsModel);
	}