#vulnerable code 
                                public static void filterActions(AllowedKeyAction.Action allowedAction,
                                     Set<AccessKeyPermission> permissions) {
        Set<AccessKeyPermission> permissionsToRemove = new HashSet<>();
        for (AccessKeyPermission currentPermission : permissions) {
            boolean isCurrentPermissionAllowed = false;
            Set<String> actions = currentPermission.getActionsAsSet();
            if (currentPermission.getAccessKey() != null  && currentPermission.getAccessKey().getUser().getRole() != UserRole.ADMIN) {
                actions.removeAll(AvailableActions.getAdminActions());
            }
            if (actions != null) {
                for (String accessKeyAction : actions) {
                    isCurrentPermissionAllowed = accessKeyAction.equalsIgnoreCase(allowedAction.getValue());
                    if (isCurrentPermissionAllowed) {
                        break;
                    }
                }
                if (!isCurrentPermissionAllowed) {
                    permissionsToRemove.add(currentPermission);
                }
            }
        }
        permissions.removeAll(permissionsToRemove);
    } 
                            #location 8 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                public static void filterActions(AllowedKeyAction.Action allowedAction,
                                     Set<AccessKeyPermission> permissions) {
        Set<AccessKeyPermission> permissionsToRemove = new HashSet<>();
        for (AccessKeyPermission currentPermission : permissions) {
            boolean isCurrentPermissionAllowed = false;
            Set<String> actions = currentPermission.getActionsAsSet();
            if (actions != null) {
                if (currentPermission.getAccessKey() != null  && currentPermission.getAccessKey().getUser().getRole() != UserRole.ADMIN) {
                    actions.removeAll(AvailableActions.getAdminActions());
                }
                for (String accessKeyAction : actions) {
                    isCurrentPermissionAllowed = accessKeyAction.equalsIgnoreCase(allowedAction.getValue());
                    if (isCurrentPermissionAllowed) {
                        break;
                    }
                }
                if (!isCurrentPermissionAllowed) {
                    permissionsToRemove.add(currentPermission);
                }
            }
        }
        permissions.removeAll(permissionsToRemove);
    }