https://docs.oracle.com/javase/8/docs/api/java/security/CodeSource.html

The constructors of CodeSource explicitely state that signers or certificates may be null, but say nothing about location - which implies that location may not be null.
Similarly - other getters are specified to return 'or null' - but not getLocation().

However, the specification of CodeSource.implies describes what happens when 'location' is null, which implies that location might be null.

If location may be null, it should be properly specified in the constructors javadoc as well as in the @return clause of getLocation().