output: #fixed code
                                  @SuppressWarnings( "unchecked" )
      private static List<Principal> getPrincipals(HttpServletRequest request) {
          List<Principal> principals = null;
  
          Session session = (Session) ThreadContext.get( ThreadContext.SESSION_KEY );
          if( session != null ) {
              principals = (List<Principal>) session.getAttribute( PRINCIPALS_SESSION_KEY );
          } else {
              HttpSession httpSession = request.getSession( false );
              if( httpSession != null ) {
                  principals =  (List<Principal>) httpSession.getAttribute( PRINCIPALS_SESSION_KEY );
              }
          }
          return principals;
      }
input: #vulnerable code 
                                  @SuppressWarnings( "unchecked" )
      private static List<Principal> getPrincipals(HttpServletRequest request) {
          List<Principal> principals = null;
  
          Session session = ThreadLocalSecurityContext.current().getSession( false );
          if( session != null ) {
              principals = (List<Principal>) session.getAttribute( PRINCIPALS_SESSION_KEY );
          } else {
              HttpSession httpSession = request.getSession( false );
              if( httpSession != null ) {
                  principals =  (List<Principal>) httpSession.getAttribute( PRINCIPALS_SESSION_KEY );
              }
          }
          return principals;
      } 
                              #location 5 
                              #vulnerability type NULL_DEREFERENCE