#vulnerable code 
                                @GET
    @Path("/start")
    @Metric(HTTP_STOP_OTA)
    public Response startOTA(@QueryParam("fileName") String filename,
                             @QueryParam("token") String token) {
        TokenValue tokenValue = tokenManager.getTokenValueByToken(token);

        if (tokenValue == null) {
            log.debug("Requested token {} not found.", token);
            return badRequest("Invalid token.");
        }

        User user = tokenValue.user;
        int deviceId = tokenValue.deviceId;

        if (user == null) {
            return badRequest("Invalid auth credentials.");
        }

        Session session = sessionDao.userSession.get(new UserKey(user));
        if (session == null) {
            log.debug("No session for user {}.", user.email);
            return badRequest("Device wasn't connected yet.");
        }

        String otaFile = OTA_DIR + (filename == null ? "firmware_ota.bin" : filename);
        String body = otaManager.buildOTAInitCommandBody(otaFile);
        if (session.sendMessageToHardware(BLYNK_INTERNAL, 7777, body)) {
            log.debug("No device in session.");
            return badRequest("No device in session.");
        }

        Device device = tokenValue.dash.getDeviceById(deviceId);

        device.updateOTAInfo(user.email);

        return ok();
    } 
                            #location 35 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @GET
    @Path("/start")
    @Metric(HTTP_STOP_OTA)
    public Response startOTA(@QueryParam("fileName") String filename,
                             @QueryParam("token") String token) {
        TokenValue tokenValue = tokenManager.getTokenValueByToken(token);

        if (tokenValue == null) {
            log.debug("Requested token {} not found.", token);
            return badRequest("Invalid token.");
        }

        User user = tokenValue.user;

        if (user == null) {
            return badRequest("Invalid auth credentials.");
        }

        Session session = sessionDao.userSession.get(new UserKey(user));
        if (session == null) {
            log.debug("No session for user {}.", user.email);
            return badRequest("Device wasn't connected yet.");
        }

        String otaFile = OTA_DIR + (filename == null ? "firmware_ota.bin" : filename);
        String body = otaManager.buildOTAInitCommandBody(otaFile);
        if (session.sendMessageToHardware(BLYNK_INTERNAL, 7777, body)) {
            log.debug("No device in session.");
            return badRequest("No device in session.");
        }

        tokenValue.device.updateOTAInfo(user.email);

        return ok();
    }