#vulnerable code 
                                public String save() {
		Command<Dataverse> cmd = null;
        
		if ( editMode == EditMode.INFO ) {
            dataverse.setOwner(ownerId != null ? dataverseService.find(ownerId) : null);
			cmd = new CreateDataverseCommand(dataverse, session.getUser());
        
		} else if ( editMode == EditMode.SETUP ) {
			cmd = new UpdateDataverseCommand(dataverse, facets.getTarget(), session.getUser());
        }
        
		try {
			dataverse = commandEngine.submit(cmd);
                        userNotificationService.sendNotification(session.getUser(), dataverse.getCreateDate(), Type.CREATEDV, dataverse.getId());
                        editMode = null;
		} catch (CommandException ex) {
			JH.addMessage(FacesMessage.SEVERITY_ERROR, ex.getMessage());
			return null;
		}
		
        return "/dataverse.xhtml?id=" + dataverse.getId() +"&faces-redirect=true";
    } 
                            #location 13 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                public String save() {
		Command<Dataverse> cmd = null;
                //TODO change to Create - for now the page is expecting INFO instead.
                if (dataverse.getId() == null){
                    dataverse.setOwner(ownerId != null ? dataverseService.find(ownerId) : null);
                    cmd = new CreateDataverseCommand(dataverse, session.getUser());
                } else {
                    cmd = new UpdateDataverseCommand(dataverse, facets.getTarget(), session.getUser());
                }

		try {
			dataverse = commandEngine.submit(cmd);
                        userNotificationService.sendNotification(session.getUser(), dataverse.getCreateDate(), Type.CREATEDV, dataverse.getId());
                        editMode = null;
		} catch (CommandException ex) {
			JH.addMessage(FacesMessage.SEVERITY_ERROR, ex.getMessage());
			return null;
		}
		
        return "/dataverse.xhtml?id=" + dataverse.getId() +"&faces-redirect=true";
    }