#vulnerable code 
                              @ApiMethod(name = "processSignResponse")
  public List<String> processSignResponse(
      @Named("responseData") String responseData, User user)
      throws OAuthRequestException, ResponseException {
    if (user == null) {
      throw new OAuthRequestException("User is not authenticated");
    }

    Gson gson = new Gson();
    JsonElement element = gson.fromJson(responseData, JsonElement.class);
    JsonObject object = element.getAsJsonObject();
    String clientDataJSON = object.get("clientDataJSON").getAsString();
    String authenticatorData = object.get("authenticatorData").getAsString();
    String signature = object.get("signature").getAsString();

    AuthenticatorAssertionResponse assertion =
        new AuthenticatorAssertionResponse(clientDataJSON, authenticatorData, signature);

    // TODO
    String credentialId = BaseEncoding.base64Url().encode(
        assertion.getAuthenticatorData().getAttData().getCredentialId());
    String type = null;
    String session = null;

    PublicKeyCredential cred = new PublicKeyCredential(credentialId, type,
        BaseEncoding.base64Url().decode(credentialId), assertion);

    try {
      U2fServer.verifyAssertion(cred, user.getEmail(), session);
    } catch (ServletException e) {
      // TODO
    }

    Credential credential = new Credential(cred);
    credential.save(user.getEmail());

    List<String> resultList = new ArrayList<String>();
    resultList.add(credential.toJson());
    return resultList;
  } 
                            #location 21 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                              @ApiMethod(name = "processSignResponse")
  public List<String> processSignResponse(
      @Named("responseData") String responseData, User user)
      throws OAuthRequestException, ResponseException {
    if (user == null) {
      throw new OAuthRequestException("User is not authenticated");
    }

    Gson gson = new Gson();
    JsonElement element = gson.fromJson(responseData, JsonElement.class);
    JsonObject object = element.getAsJsonObject();
    String clientDataJSON = object.get("clientDataJSON").getAsString();
    String authenticatorData = object.get("authenticatorData").getAsString();
    String credentialId = object.get("credentialId").getAsString();
    String signature = object.get("signature").getAsString();

    AuthenticatorAssertionResponse assertion =
        new AuthenticatorAssertionResponse(clientDataJSON, authenticatorData, signature);

    // TODO
    String type = null;
    String session = null;

    PublicKeyCredential cred = new PublicKeyCredential(credentialId, type,
        BaseEncoding.base64Url().decode(credentialId), assertion);

    try {
      U2fServer.verifyAssertion(cred, user.getEmail(), session);
    } catch (ServletException e) {
      // TODO
    }

    Credential credential = new Credential(cred);
    credential.save(user.getEmail());

    List<String> resultList = new ArrayList<String>();
    resultList.add(credential.toJson());
    return resultList;
  }