#vulnerable code 
                                public static AccessRight decodeJSON(JSONObject node) {
        AccessRight right = new AccessRight();

        // The values are stored as longs internally, despite us passing an int
        right.setProtectionId(((Long) node.get("protection")).intValue());
        right.setType(((Long) node.get("type")).intValue());
        right.setName((String) node.get("name"));
        right.setRights(((Long) node.get("rights")).intValue());

        return right;
    } 
                            #location 5 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                public static AccessRight decodeJSON(JSONObject node) {
        AccessRight right = new AccessRight();

        // The values are stored as longs internally, despite us passing an int
        // right.setProtectionId(((Long) node.get("protection")).intValue());
        right.setType(((Long) node.get("type")).intValue());
        right.setName((String) node.get("name"));
        right.setRights(((Long) node.get("rights")).intValue());

        return right;
    }