I can't tell if the
NullPointerException refers to getFoos
returning null or some problem with
the cast from a Collection to an
ArrayList.
And that's why we have the Law of Demeter. If you separate the two statements that have been conjoined together, you would have better luck in resolving the issue.
However, it should be apparent that a null collection (not an empty collection) is returned which is responsible for the issue. After all, invoking the ArrayList constructor with a null collection will not result in a null pointer exception.
EDIT:
My bad. The ArrayList constructor will attempt to copy the collection. So a null collection can cause a null pointer exception. I stick to my original recommendation of decoupling the two statements. Coding in the following manner will help identify the issue faster:
Collection<Foo> myFoos = userDetailsService.getFoos(currentUser);
List<Foo> foos = new ArrayList<Foo>(myFoos);