output: #fixed code
                                  public String save() {
  		Command<Dataverse> cmd = null;
                  //TODO change to Create - for now the page is expecting INFO instead.
                  if (dataverse.getId() == null){
                      dataverse.setOwner(ownerId != null ? dataverseService.find(ownerId) : null);
                      cmd = new CreateDataverseCommand(dataverse, session.getUser());
                  } else {
                      cmd = new UpdateDataverseCommand(dataverse, facets.getTarget(), session.getUser());
                  }
  
  		try {
  			dataverse = commandEngine.submit(cmd);
                          userNotificationService.sendNotification(session.getUser(), dataverse.getCreateDate(), Type.CREATEDV, dataverse.getId());
                          editMode = null;
  		} catch (CommandException ex) {
  			JH.addMessage(FacesMessage.SEVERITY_ERROR, ex.getMessage());
  			return null;
  		}
  		
          return "/dataverse.xhtml?id=" + dataverse.getId() +"&faces-redirect=true";
      }
input: #vulnerable code 
                                  public String save() {
  		Command<Dataverse> cmd = null;
          
  		if ( editMode == EditMode.INFO ) {
              dataverse.setOwner(ownerId != null ? dataverseService.find(ownerId) : null);
  			cmd = new CreateDataverseCommand(dataverse, session.getUser());
          
  		} else if ( editMode == EditMode.SETUP ) {
  			cmd = new UpdateDataverseCommand(dataverse, facets.getTarget(), session.getUser());
          }
          
  		try {
  			dataverse = commandEngine.submit(cmd);
                          userNotificationService.sendNotification(session.getUser(), dataverse.getCreateDate(), Type.CREATEDV, dataverse.getId());
                          editMode = null;
  		} catch (CommandException ex) {
  			JH.addMessage(FacesMessage.SEVERITY_ERROR, ex.getMessage());
  			return null;
  		}
  		
          return "/dataverse.xhtml?id=" + dataverse.getId() +"&faces-redirect=true";
      } 
                              #location 13 
                              #vulnerability type NULL_DEREFERENCE