#vulnerable code 
                             public static <T> MashapeResponse<T> doRequest (Class<T> clazz, HttpMethod httpMethod, String url, Map<String, Object> parameters, ContentType contentType, ResponseType responseType, List<Authentication> authenticationHandlers) {
		if (authenticationHandlers == null) authenticationHandlers = new ArrayList<Authentication>();
		if (parameters == null) parameters = new HashMap<String, Object>();
		
		List<Header> headers = new LinkedList<Header>();
		
		// Handle authentications
		for (Authentication authentication : authenticationHandlers) {
			if (authentication instanceof HeaderAuthentication) {
				headers.addAll(authentication.getHeaders());
			} else {
				Map<String, String> queryParameters = authentication.getQueryParameters();
				if (authentication instanceof QueryAuthentication) {
					parameters.putAll(queryParameters);
				} else if (authentication instanceof OAuth10aAuthentication) {
					if (url.endsWith("/oauth_url") == false && (queryParameters == null || 
							queryParameters.get(OAuthAuthentication.ACCESS_SECRET) == null || 
							queryParameters.get(OAuthAuthentication.ACCESS_TOKEN) == null)) {
						throw new RuntimeException("Before consuming OAuth endpoint, invoke authorize('access_token','access_secret') with not null values");
					}
					headers.add(new BasicHeader("x-mashape-oauth-consumerkey", queryParameters.get(OAuthAuthentication.CONSUMER_KEY)));
					headers.add(new BasicHeader("x-mashape-oauth-consumersecret", queryParameters.get(OAuthAuthentication.CONSUMER_SECRET)));
					headers.add(new BasicHeader("x-mashape-oauth-accesstoken", queryParameters.get(OAuthAuthentication.ACCESS_TOKEN)));
					headers.add(new BasicHeader("x-mashape-oauth-accesssecret", queryParameters.get(OAuthAuthentication.ACCESS_SECRET)));
					
				} else if (authentication instanceof OAuth2Authentication) {
					if (url.endsWith("/oauth_url") == false && (queryParameters == null || 
							queryParameters.get(OAuthAuthentication.ACCESS_TOKEN) == null)) {
						throw new RuntimeException("Before consuming OAuth endpoint, invoke authorize('access_token') with a not null value");
					}
					parameters.put("access_token", queryParameters.get(OAuthAuthentication.ACCESS_TOKEN));
				}
			}
		}
		
		// Sanitize null parameters
		Set<String> keySet = new HashSet<String>(parameters.keySet());
		for (String key : keySet) {
			if (parameters.get(key) == null) {
				parameters.remove(key);
			}
		}
		
		headers.add(new BasicHeader("User-Agent", USER_AGENT));
		
		HttpUriRequest request = null;
		
		switch(httpMethod) {
		case GET:
			request = new HttpGet(url + "?" + HttpUtils.getQueryString(parameters));
			break;
		case POST:
			request = new HttpPost(url);
			break;
		case PUT:
			request = new HttpPut(url);
			break;
		case DELETE:
			request = new HttpDeleteWithBody(url);
			break;
		case PATCH:
			request = new HttpPatchWithBody(url);
			break;
		}
		
		for(Header header : headers) {
			request.addHeader(header);
		}

		if (httpMethod != HttpMethod.GET) {
			switch(contentType) {
			case BINARY:
				MultipartEntity entity = new MultipartEntity();
				for(Entry<String, Object> parameter : parameters.entrySet()) {
					if (parameter.getValue() instanceof File) {
						entity.addPart(parameter.getKey(), new FileBody((File) parameter.getValue()));
					} else {
						try {
							entity.addPart(parameter.getKey(), new StringBody(parameter.getValue().toString(), Charset.forName("UTF-8")));
						} catch (UnsupportedEncodingException e) {
							throw new RuntimeException(e);
						}
					}
				}
				((HttpEntityEnclosingRequestBase) request).setEntity(entity);
				break;
			case FORM:
				try {
					((HttpEntityEnclosingRequestBase) request).setEntity(new UrlEncodedFormEntity(MapUtil.getList(parameters), HTTP.UTF_8));
				} catch (UnsupportedEncodingException e) {
					throw new RuntimeException(e);
				}
				break;
			case JSON:
				String jsonBody = null;
				
				if((parameters.get(JSON_PARAM_BODY) == null)) {
					String jsonParamBody =  parameters.get(JSON_PARAM_BODY).toString();
					jsonBody = (HttpUtils.isJson(jsonParamBody)) ? jsonParamBody : gson.toJson(jsonParamBody);
				}

				try {
					((HttpEntityEnclosingRequestBase) request).setEntity(new StringEntity(jsonBody, "UTF-8"));
					((HttpEntityEnclosingRequestBase) request).setHeader(new BasicHeader("Content-Type", "application/json"));
				} catch (UnsupportedEncodingException e) {
					throw new RuntimeException(e);
				}
			}
		}
		
		org.apache.http.client.HttpClient client = new DefaultHttpClient();
		
		HttpResponse response;
		try {
			response = client.execute(request);
		} catch (Exception e) {
			throw new RuntimeException(e);
		}
		MashapeResponse<T> mashapeResponse = HttpUtils.getResponse(responseType, response);
		return mashapeResponse;
	} 
                            #location 98 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             public static <T> MashapeResponse<T> doRequest (Class<T> clazz, HttpMethod httpMethod, String url, Map<String, Object> parameters, ContentType contentType, ResponseType responseType, List<Authentication> authenticationHandlers) {
		if (authenticationHandlers == null) authenticationHandlers = new ArrayList<Authentication>();
		if (parameters == null) parameters = new HashMap<String, Object>();
		
		List<Header> headers = new LinkedList<Header>();
		
		// Handle authentications
		for (Authentication authentication : authenticationHandlers) {
			if (authentication instanceof HeaderAuthentication) {
				headers.addAll(authentication.getHeaders());
			} else {
				Map<String, String> queryParameters = authentication.getQueryParameters();
				if (authentication instanceof QueryAuthentication) {
					parameters.putAll(queryParameters);
				} else if (authentication instanceof OAuth10aAuthentication) {
					if (url.endsWith("/oauth_url") == false && (queryParameters == null || 
							queryParameters.get(OAuthAuthentication.ACCESS_SECRET) == null || 
							queryParameters.get(OAuthAuthentication.ACCESS_TOKEN) == null)) {
						throw new RuntimeException("Before consuming OAuth endpoint, invoke authorize('access_token','access_secret') with not null values");
					}
					headers.add(new BasicHeader("x-mashape-oauth-consumerkey", queryParameters.get(OAuthAuthentication.CONSUMER_KEY)));
					headers.add(new BasicHeader("x-mashape-oauth-consumersecret", queryParameters.get(OAuthAuthentication.CONSUMER_SECRET)));
					headers.add(new BasicHeader("x-mashape-oauth-accesstoken", queryParameters.get(OAuthAuthentication.ACCESS_TOKEN)));
					headers.add(new BasicHeader("x-mashape-oauth-accesssecret", queryParameters.get(OAuthAuthentication.ACCESS_SECRET)));
					
				} else if (authentication instanceof OAuth2Authentication) {
					if (url.endsWith("/oauth_url") == false && (queryParameters == null || 
							queryParameters.get(OAuthAuthentication.ACCESS_TOKEN) == null)) {
						throw new RuntimeException("Before consuming OAuth endpoint, invoke authorize('access_token') with a not null value");
					}
					parameters.put("access_token", queryParameters.get(OAuthAuthentication.ACCESS_TOKEN));
				}
			}
		}
		
		// Sanitize null parameters
		Set<String> keySet = new HashSet<String>(parameters.keySet());
		for (String key : keySet) {
			if (parameters.get(key) == null) {
				parameters.remove(key);
			}
		}
		
		headers.add(new BasicHeader("User-Agent", USER_AGENT));
		
		HttpUriRequest request = null;
		
		switch(httpMethod) {
		case GET:
			request = new HttpGet(url + "?" + HttpUtils.getQueryString(parameters));
			break;
		case POST:
			request = new HttpPost(url);
			break;
		case PUT:
			request = new HttpPut(url);
			break;
		case DELETE:
			request = new HttpDeleteWithBody(url);
			break;
		case PATCH:
			request = new HttpPatchWithBody(url);
			break;
		}
		
		for(Header header : headers) {
			request.addHeader(header);
		}

		if (httpMethod != HttpMethod.GET) {
			switch(contentType) {
			case BINARY:
				MultipartEntity entity = new MultipartEntity();
				for(Entry<String, Object> parameter : parameters.entrySet()) {
					if (parameter.getValue() instanceof File) {
						entity.addPart(parameter.getKey(), new FileBody((File) parameter.getValue()));
					} else {
						try {
							entity.addPart(parameter.getKey(), new StringBody(parameter.getValue().toString(), Charset.forName("UTF-8")));
						} catch (UnsupportedEncodingException e) {
							throw new RuntimeException(e);
						}
					}
				}
				((HttpEntityEnclosingRequestBase) request).setEntity(entity);
				break;
			case FORM:
				try {
					((HttpEntityEnclosingRequestBase) request).setEntity(new UrlEncodedFormEntity(MapUtil.getList(parameters), HTTP.UTF_8));
				} catch (UnsupportedEncodingException e) {
					throw new RuntimeException(e);
				}
				break;
			case JSON:
				String jsonBody = null;
				
				if((parameters.get(JSON_PARAM_BODY) != null)) {
					String jsonParamBody =  parameters.get(JSON_PARAM_BODY).toString();
					jsonBody = (HttpUtils.isJson(jsonParamBody)) ? jsonParamBody : gson.toJson(jsonParamBody);
				}

				try {
					((HttpEntityEnclosingRequestBase) request).setEntity(new StringEntity(jsonBody, "UTF-8"));
					((HttpEntityEnclosingRequestBase) request).setHeader(new BasicHeader("Content-Type", "application/json"));
				} catch (UnsupportedEncodingException e) {
					throw new RuntimeException(e);
				}
			}
		}
		
		org.apache.http.client.HttpClient client = new DefaultHttpClient();
		
		HttpResponse response;
		try {
			response = client.execute(request);
		} catch (Exception e) {
			throw new RuntimeException(e);
		}
		MashapeResponse<T> mashapeResponse = HttpUtils.getResponse(responseType, response);
		return mashapeResponse;
	}