fuzz: Fix breadth first handling

[kingthorin]

Overview

• Fix multi-location breadth payload combination (was incorrectly using depth-first-style iteration).
• Rename strategies to Cluster Bomb and Pitchfork in code, UI, help, and tests; keep legacy depth/breadth config values working.
• Update WebSockets fuzz handler for renamed Fuzzer replacer classes. (Build file was previously updated.)

From the payload lists 1,2,3 and a,b,c Pitchfork produces:

Related Issues

• Support for fuzzing multiple parts
• fuzzer: Update Help

AI Disclosure

Cursor was used in the preparation of this change/PR.

[psiinon]

Checkmarx One – Scan Summary & Details – 8511e4a1-54c0-4d7e-8796-4aeca3fdbf97

Great job! No new security vulnerabilities introduced in this pull request

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

[thc202]

This is just inverting depth not changing to breadth.

[thc202]

1a 2b 3c

[thc202]

Hide the UI components instead of removing all the code, the migration is also not needed, they behave the same.

[Copilot]

Pull request overview

This PR updates the fuzzing payload-combination strategies to align with common “Cluster Bomb” and “Pitchfork” semantics, fixes multi-location iteration order, and propagates the renames through handlers, UI, help, and tests across the fuzz and websocket add-ons.

Changes:

• Fix multi-location payload combination for the (formerly breadth-first) strategy by implementing Pitchfork lockstep iteration.
• Rename payload replacement strategies to Cluster Bomb and Pitchfork, while keeping legacy config values (depth/breadth) working.
• Update HTTP/WebSocket fuzzer handlers, UI labels, help content, and add unit coverage for the new strategies.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
addOns/websocket/src/main/java/org/zaproxy/zap/extension/websocket/fuzz/WebSocketFuzzerHandler.java	Switch strategy wiring to the renamed multi-location replacers.
addOns/websocket/CHANGELOG.md	Document websocket add-on update for renamed strategy handling.
addOns/fuzz/src/test/java/org/zaproxy/zap/extension/fuzz/messagelocations/MultipleMessageLocationsReplacerUnitTest.java	Add unit tests covering iteration order and replacement-count behavior for both strategies.
addOns/fuzz/src/main/resources/org/zaproxy/zap/extension/fuzz/resources/Messages.properties	Update base i18n keys/labels to “Cluster Bomb” and “Pitchfork”.
addOns/fuzz/src/main/javahelp/org/zaproxy/zap/extension/fuzz/resources/help/contents/options.html	Expand help text with definitions/examples for Cluster Bomb vs Pitchfork behavior.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/messagelocations/MultipleMessageLocationsPitchforkReplacer.java	Rename and rework the former breadth-first replacer to implement Pitchfork lockstep iteration and count semantics.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/messagelocations/MultipleMessageLocationsClusterBombReplacer.java	Rename the former depth-first replacer to Cluster Bomb.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/messagelocations/MessageLocationsReplacementStrategy.java	Rename enum values/config ids and add legacy mapping for old config values.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/FuzzerOptionsPanel.java	Update UI radio buttons and selection logic for renamed strategies.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/httpfuzzer/HttpFuzzerHandler.java	Switch strategy wiring to the renamed multi-location replacers.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/FuzzOptionsPanel.java	Update options panel to save/load the renamed strategy values.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/FuzzOptions.java	Update default strategy config id to the renamed value.
addOns/fuzz/CHANGELOG.md	Document the strategy rename and the multi-location Pitchfork fix in the fuzz add-on changelog.

Comments suppressed due to low confidence (1)

addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/messagelocations/MultipleMessageLocationsPitchforkReplacer.java:65

• listCurrentReplacements is sized from the original generator set, but only indices [0..replacementGenerators.size()) are ever populated. If any generator is skipped during init (e.g. mlr.hasNext() is false), the array will retain nulls and currentReplacements.addAll(Arrays.asList(listCurrentReplacements)) will throw a NullPointerException. Also, numberOfReplacements currently computes the min of known sizes even if any generator reports UNKNOWN, which can misreport totals; if any generator is UNKNOWN the result should remain UNKNOWN.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.