#vulnerable code 
                             private void doGetExportCvs(HttpServletRequest req, HttpServletResponse resp) throws IOException{
		resp.setHeader("Content-disposition","attachment; filename=QueryResultsExport.csv");
		String queryString = req.getParameter("query");
		String[] fields = req.getParameterValues("fields");
		String[] providers = req.getParameterValues("providers");
		boolean keyword = Boolean.parseBoolean(req.getParameter("keyword"));
		
		System.out.println("queryString: "+ queryString);
		for(String field: fields)
		System.out.println("field: "+ field);
		System.out.println("keyword: "+ keyword);
		
		if(queryString == null)
			resp.sendError(401, "Query Parameters not found");
		
		if(fields == null || fields.length==0)
			resp.sendError(402, "Fields Parameters not found");
		
		if (!keyword) {
            QueryExpressionBuilder q = new QueryExpressionBuilder(queryString);
            queryString = q.getQueryString();
        }

						    	
	    List<String> fieldList = new ArrayList<>(fields.length);
	    Map<String, String> fieldsMap = new HashMap<>();
	    for(String f : fields){
	    	fieldList.add(f);
	    	fieldsMap.put(f, f);
	    }
	    	    	    
    	ExportToCSVQueryTask task = new ExportToCSVQueryTask( fieldList,
				resp.getOutputStream());

    	if(providers == null || providers.length == 0) {
			PluginController.getInstance().queryAll(task, queryString, fieldsMap);
		} else {
			List<String> providersList = new ArrayList<>();
			for (String f : providers) {
				providersList.add(f);
			}
			PluginController.getInstance().query(task, providersList, queryString,
					fieldsMap);
		}

		task.await();
	} 
                            #location 20 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             private void doGetExportCvs(HttpServletRequest req, HttpServletResponse resp) throws IOException{
		resp.setHeader("Content-disposition","attachment; filename=QueryResultsExport.csv");
		String queryString = req.getParameter("query");
		String[] fields = req.getParameterValues("fields");
		String[] providers = req.getParameterValues("providers");
		boolean keyword = Boolean.parseBoolean(req.getParameter("keyword"));
		
		logger.debug("queryString: {}", queryString);
		logger.debug("fields: {}", Arrays.asList(fields));
		logger.debug("keyword: {}", keyword);
		
		if(queryString == null)
			resp.sendError(401, "Query Parameters not found");
		
		if(fields == null || fields.length==0)
			resp.sendError(402, "Fields Parameters not found");
		
		if (!keyword) {
            QueryExpressionBuilder q = new QueryExpressionBuilder(queryString);
            queryString = q.getQueryString();
        }

						    	
	    List<String> fieldList = Arrays.asList(fields);
	    Map<String, String> fieldsMap = new HashMap<>();
	    for(String f : fields){
	    	fieldsMap.put(f, f);
	    }
	    	    	    
    	ExportToCSVQueryTask task = new ExportToCSVQueryTask( fieldList,
				resp.getOutputStream());

    	if(providers == null || providers.length == 0) {
			PluginController.getInstance().queryAll(task, queryString, fieldsMap);
		} else {
			List<String> providersList = Arrays.asList(providers);
			PluginController.getInstance().query(task, providersList, queryString,
					fieldsMap);
		}

		task.await();
	}