#vulnerable code 
                                @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String path = httpRequest.getServletPath();

        if (path.startsWith("/ws/")) {
            String sessionKey = getSessionKey(httpRequest);
            String sysRole = null;
            boolean isAuthByApiKey = false;
            if (sessionKey != null) {
                User user = userService.getUserBySessionKey(sessionKey);
                user.setSessionKey(sessionKey);
                if (user != null) {
                    httpRequest.setAttribute(Constants.HTTP_REQUEST_ATTR_USER, user);
                    sysRole = user.getSysRole();
                }
            } else {
                String apiKey = httpRequest.getHeader(Constants.HTTP_HEADER_API_KEY);
                if (apiKey != null) {
                    User user = userService.getUserByApiKey(apiKey);
                    if (user != null) {
                        httpRequest.setAttribute(Constants.HTTP_REQUEST_ATTR_USER, user);
                        sysRole = user.getSysRole();
                        isAuthByApiKey = true;
                    }
                }
            }

            if (sysRole != null) {
                boolean isValid = false;
                if (isAuthByApiKey) {
                    // Authorized by using API key
                    isValid = validateByApiKey(httpRequest.getMethod(), path);
                } else {
                    // Authorized by using cookie.
                    if (Constants.SYS_ROLE_VIEWER.equals(sysRole)) {
                        isValid = validateViewer(httpRequest.getMethod(), path);
                    } else if (Constants.SYS_ROLE_DEVELOPER.equals(sysRole) || Constants.SYS_ROLE_ADMIN.equals(sysRole)) {
                        isValid = true;
                    } else {
                        isValid = false;
                    }
                }

                if (isValid) {
                    chain.doFilter(request, response);
                } else {
                    return401(response);
                }
            } else {
                return401(response);
            }
        } else {
            chain.doFilter(request, response);
        }
    } 
                            #location 12 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String path = httpRequest.getServletPath();

        if (path.startsWith("/ws/")) {
            String sessionKey = getSessionKey(httpRequest);
            String sysRole = null;
            boolean isAuthByApiKey = false;
            if (sessionKey != null) {
                User user = userService.getUserBySessionKey(sessionKey);
                if (user != null) {
                    user.setSessionKey(sessionKey);
                    httpRequest.setAttribute(Constants.HTTP_REQUEST_ATTR_USER, user);
                    sysRole = user.getSysRole();
                }
            } else {
                String apiKey = httpRequest.getHeader(Constants.HTTP_HEADER_API_KEY);
                if (apiKey != null) {
                    User user = userService.getUserByApiKey(apiKey);
                    if (user != null) {
                        httpRequest.setAttribute(Constants.HTTP_REQUEST_ATTR_USER, user);
                        sysRole = user.getSysRole();
                        isAuthByApiKey = true;
                    }
                }
            }

            if (sysRole != null) {
                boolean isValid = false;
                if (isAuthByApiKey) {
                    // Authorized by using API key
                    isValid = validateByApiKey(httpRequest.getMethod(), path);
                } else {
                    // Authorized by using cookie.
                    if (Constants.SYS_ROLE_VIEWER.equals(sysRole)) {
                        isValid = validateViewer(httpRequest.getMethod(), path);
                    } else if (Constants.SYS_ROLE_DEVELOPER.equals(sysRole) || Constants.SYS_ROLE_ADMIN.equals(sysRole)) {
                        isValid = true;
                    } else {
                        isValid = false;
                    }
                }

                if (isValid) {
                    chain.doFilter(request, response);
                } else {
                    return401(response);
                }
            } else {
                return401(response);
            }
        } else {
            chain.doFilter(request, response);
        }
    }