#vulnerable code 
                                public void handleWebHook(String event, String payload, String body, String signature) {
        if (!checkSignature(body, signature, trigger.getGitHubApiAuth().getSecret())){
            return;
        }

        GhprbRepository repo = trigger.getRepository();
        String repoName = repo.getName();

        logger.log(Level.INFO, "Got payload event: {0}", event);
        try {
            GitHub gh = trigger.getGitHub();
            
            if ("issue_comment".equals(event)) {
                GHEventPayload.IssueComment issueComment = gh.parseEventPayload(
                        new StringReader(payload), 
                        GHEventPayload.IssueComment.class);
                GHIssueState state = issueComment.getIssue().getState();
                if (state == GHIssueState.CLOSED) {
                    logger.log(Level.INFO, "Skip comment on closed PR");
                    return;
                }
                
                if (matchRepo(repo, issueComment.getRepository())) {
                    logger.log(Level.INFO, "Checking issue comment ''{0}'' for repo {1}", 
                            new Object[] { issueComment.getComment(), repoName }
                    );
                    repo.onIssueCommentHook(issueComment);
                }

            } else if ("pull_request".equals(event)) {
                GHEventPayload.PullRequest pr = gh.parseEventPayload(
                        new StringReader(payload), 
                        GHEventPayload.PullRequest.class);
                if (matchRepo(repo, pr.getPullRequest().getRepository())) {
                    logger.log(Level.INFO, "Checking PR #{1} for {0}", new Object[] { repoName, pr.getNumber() });
                    repo.onPullRequestHook(pr);
                }
                
            } else {
                logger.log(Level.WARNING, "Request not known");
            }
        } catch (IOException ex) {
            logger.log(Level.SEVERE, "Failed to parse github hook payload for " + trigger.getProject(), ex);
        }
    } 
                            #location 2 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                public void handleWebHook(String event, String payload, String body, String signature) {

        GhprbRepository repo = trigger.getRepository();
        String repoName = repo.getName();

        logger.log(Level.INFO, "Got payload event: {0}", event);
        try {
            GitHub gh = trigger.getGitHub();
            
            if ("issue_comment".equals(event)) {
                GHEventPayload.IssueComment issueComment = gh.parseEventPayload(
                        new StringReader(payload), 
                        GHEventPayload.IssueComment.class);
                GHIssueState state = issueComment.getIssue().getState();
                if (state == GHIssueState.CLOSED) {
                    logger.log(Level.INFO, "Skip comment on closed PR");
                    return;
                }
                
                if (matchRepo(repo, issueComment.getRepository())) {
                    if (!checkSignature(body, signature, trigger.getGitHubApiAuth().getSecret())){
                        return;
                    }

                    logger.log(Level.INFO, "Checking issue comment ''{0}'' for repo {1}", 
                            new Object[] { issueComment.getComment(), repoName }
                    );
                    repo.onIssueCommentHook(issueComment);
                }

            } else if ("pull_request".equals(event)) {
                GHEventPayload.PullRequest pr = gh.parseEventPayload(
                        new StringReader(payload), 
                        GHEventPayload.PullRequest.class);
                if (matchRepo(repo, pr.getPullRequest().getRepository())) {
                    if (!checkSignature(body, signature, trigger.getGitHubApiAuth().getSecret())){
                        return;
                    }

                    logger.log(Level.INFO, "Checking PR #{1} for {0}", new Object[] { repoName, pr.getNumber() });
                    repo.onPullRequestHook(pr);
                }
                
            } else {
                logger.log(Level.WARNING, "Request not known");
            }
        } catch (IOException ex) {
            logger.log(Level.SEVERE, "Failed to parse github hook payload for " + trigger.getProject(), ex);
        }
    }