fuzz: Fix breadth/depth handling

Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>

Author: kingthorin

addOns/fuzz/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this add-on will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## Unreleased
+### Fixed
+- Correct breadth-first payload replacement order when fuzzing multiple locations.
+- Breadth-first fuzz scans no longer report zero total requests when the number of payloads is known.
+
 ### Changed
 - Update minimum ZAP version to 2.17.0.
 - Update dependency.

addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/messagelocations/MultipleMessageLocationsBreadthFirstReplacer.java

@@ -29,6 +29,10 @@
 import org.zaproxy.zap.extension.httppanel.Message;
 import org.zaproxy.zap.model.InvalidMessageException;
 
+/**
+ * Iterates the Cartesian product of payload lists with the first fuzz position (by {@code
+ * MessageLocation} sort order) changing fastest.
+ */
 public class MultipleMessageLocationsBreadthFirstReplacer<T extends Message>
         implements MultipleMessageLocationsReplacer<T> {
 
@@ -44,8 +48,8 @@ public class MultipleMessageLocationsBreadthFirstReplacer<T extends Message>
     private boolean initialised;
     private boolean setup;
 
-    private int tailIndex;
-    private MessageLocationReplacementGenerator<?, ?> tail;
+    private int headIndex;
+    private MessageLocationReplacementGenerator<?, ?> head;
 
     private long numberOfReplacements;
 
@@ -65,6 +69,7 @@ public void init(
         listCurrentReplacements =
                 new MessageLocationReplacement<?>[messageLocationReplacementGenerator.size()];
 
+        numberOfReplacements = 1;
         replacementGenerators = new ArrayList<>(messageLocationReplacementGenerator.size());
         for (MessageLocationReplacementGenerator<?, ?> mlr : messageLocationReplacementGenerator) {
             if (mlr.hasNext()) {
@@ -76,10 +81,11 @@ public void init(
                 replacementGenerators.add(mlr);
             }
         }
-        numberOfReplacements = 0;
 
-        tailIndex = replacementGenerators.size() - 1;
-        tail = replacementGenerators.get(tailIndex);
+        headIndex = 0;
+        if (!replacementGenerators.isEmpty()) {
+            head = replacementGenerators.get(headIndex);
+        }
         initialised = true;
         setup = true;
     }
@@ -91,7 +97,7 @@ public long getNumberOfReplacements() {
 
     @Override
     public boolean hasNext() {
-        for (int i = tailIndex; i >= 0; i--) {
+        for (int i = headIndex; i < replacementGenerators.size(); i++) {
             if (replacementGenerators.get(i).hasNext()) {
                 return true;
             }
@@ -100,16 +106,16 @@ public boolean hasNext() {
     }
 
     @Override
-    public T next() throws InvalidMessageException {
+    public T next() throws ReplacementException, InvalidMessageException {
         if (setup) {
             setup();
             setup = false;
         }
 
-        if (!tail.hasNext()) {
-            tail.reset();
+        if (!head.hasNext()) {
+            head.reset();
 
-            for (int i = tailIndex - 1; i >= 0; i--) {
+            for (int i = headIndex + 1; i < replacementGenerators.size(); i++) {
                 if (replacementGenerators.get(i).hasNext()) {
                     listCurrentReplacements[i] = replacementGenerators.get(i).next();
                     break;
@@ -120,7 +126,7 @@ public T next() throws InvalidMessageException {
             }
         }
 
-        listCurrentReplacements[tailIndex] = tail.next();
+        listCurrentReplacements[headIndex] = head.next();
 
         currentReplacements.clear();
         currentReplacements.addAll(Arrays.asList(listCurrentReplacements));
@@ -129,7 +135,7 @@ public T next() throws InvalidMessageException {
     }
 
     private void setup() {
-        for (int i = 0; i < tailIndex; i++) {
+        for (int i = headIndex + 1; i < replacementGenerators.size(); i++) {
             if (replacementGenerators.get(i).hasNext()) {
                 listCurrentReplacements[i] = replacementGenerators.get(i).next();
             }

addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/messagelocations/MultipleMessageLocationsDepthFirstReplacer.java

@@ -29,6 +29,10 @@
 import org.zaproxy.zap.extension.httppanel.Message;
 import org.zaproxy.zap.model.InvalidMessageException;
 
+/**
+ * Iterates the Cartesian product of payload lists with the last fuzz position (by {@code
+ * MessageLocation} sort order) changing fastest.
+ */
 public class MultipleMessageLocationsDepthFirstReplacer<T extends Message>
         implements MultipleMessageLocationsReplacer<T> {
 

addOns/fuzz/src/main/javahelp/org/zaproxy/zap/extension/fuzz/resources/help/contents/options.html

@@ -30,7 +30,13 @@ <H3>Max. Errors Allowed</H3>
 If the number of errors exceed this limit, the fuzzer will stop its execution.
 
 <H3>Payload Replacement Strategy</H3>
-Rules defined to control the order that multiple payload lists are iterated.
+Rules defined to control the order that multiple payload lists are iterated when fuzzing more than one location.<br>
+The order follows the message location sort order, not the order the locations were added in the Fuzz dialog.<br>
+<ul>
+<li><strong>Depth First</strong> - exhausts all payloads in the last fuzz position before changing payloads in earlier positions.</li>
+<li><strong>Breadth First</strong> - exhausts all payloads in the first fuzz position before changing payloads in later positions.</li>
+</ul>
+With a single fuzz location both strategies produce the same order.
 
 <H3>Concurrent Scanning Threads per Scan</H3>
 The number of threads the fuzzer will use per scan.<br>