#vulnerable code 
                                @Action(value = "notification/unsubscribe")
    public JsonObject processNotificationUnsubscribe(JsonObject message, Session session) {
        logger.debug("notification/unsubscribe action. Session " + session.getId());
        Gson gson = GsonFactory.createGson();
        List<UUID> list = gson.fromJson(message.get(JsonMessageBuilder.DEVICE_GUIDS), new TypeToken<List<UUID>>() {
        }.getType());
        try {
            WebsocketSession.getNotificationSubscriptionsLock(session).lock();
            List<Device> devices = null;
            if (list != null && !list.isEmpty()) {
                devices = deviceDAO.findByUUID(list);

            }
            logger.debug("notification/unsubscribe. found " + devices.size() +
                    " devices. " + "Session " + session.getId());
            logger.debug("notification/unsubscribe. performing unsubscribing action");
            localMessageBus.unsubscribeFromNotifications(session.getId(), devices);
        } finally {
            WebsocketSession.getNotificationSubscriptionsLock(session).unlock();
        }
        JsonObject jsonObject = JsonMessageBuilder.createSuccessResponseBuilder().build();
        logger.debug("notification/unsubscribe completed for session " + session.getId());
        return jsonObject;
    } 
                            #location 14 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @Action(value = "notification/unsubscribe")
    public JsonObject processNotificationUnsubscribe(JsonObject message, Session session) {
        logger.debug("notification/unsubscribe action. Session " + session.getId());
        Gson gson = GsonFactory.createGson();
        List<UUID> list = gson.fromJson(message.get(JsonMessageBuilder.DEVICE_GUIDS), new TypeToken<List<UUID>>() {
        }.getType());
        try {
            WebsocketSession.getNotificationSubscriptionsLock(session).lock();
            List<Device> devices = null;
            if (list != null && !list.isEmpty()) {
                devices = deviceDAO.findByUUID(list);
                logger.debug("notification/unsubscribe. found " + devices.size() +
                        " devices. " + "Session " + session.getId());
            }
            logger.debug("notification/unsubscribe. performing unsubscribing action");
            localMessageBus.unsubscribeFromNotifications(session.getId(), devices);
        } finally {
            WebsocketSession.getNotificationSubscriptionsLock(session).unlock();
        }
        JsonObject jsonObject = JsonMessageBuilder.createSuccessResponseBuilder().build();
        logger.debug("notification/unsubscribe completed for session " + session.getId());
        return jsonObject;
    }