Skip to content

fuzz: Reduce use of generics#7258

Draft
ricekot wants to merge 1 commit intozaproxy:mainfrom
ricekot:fuzz/reduce-generics
Draft

fuzz: Reduce use of generics#7258
ricekot wants to merge 1 commit intozaproxy:mainfrom
ricekot:fuzz/reduce-generics

Conversation

@ricekot
Copy link
Copy Markdown
Member

@ricekot ricekot commented Apr 7, 2026 •
edited
Loading

Remove generic type parameters that provided no real type safety:

  • Remove from all interfaces, classes, and methods, replacing with the Payload interface in type declarations. DefaultPayload is the only implementation and no add-on ever used a custom payload type.

  • Remove generic type parameters from the UI hierarchy: PayloadGeneratorUI, PayloadGeneratorUIHandler, PayloadGeneratorUIPanel, PayloadProcessorUI, PayloadProcessorUIHandler, PayloadProcessorUIPanel, and all abstract/concrete implementations. Every consumer already used wildcards or unchecked casts, so the generics added no safety.

  • Remove dead getPayloadGeneratorClass() and getPayloadProcessorClass() methods from PayloadGeneratorUI and PayloadProcessorUI interfaces and all 23 implementations. These were never called anywhere in the codebase.

  • Delete tagging interfaces StringPayloadGenerator and DefaultPayloadProcessor that existed solely to bind DefaultPayload into generic parents.

The generics are preserved as the websocket add-on depends on them with WebSocketMessageDTO.

@ricekot ricekot requested a review from Copilot April 7, 2026 13:04
Copilot AI reviewed Apr 7, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR simplifies the fuzz add-on’s payload and UI APIs by removing generics that were not providing meaningful type safety, and by deleting unused/tagging interfaces and dead methods. It standardises most fuzz payload types around the Payload interface (while preserving message generics where needed, e.g. WebSocket).

Changes:

  • Remove <T extends Payload> generics across payload generators/processors and their UI handler/panel hierarchies, using Payload directly.
  • Delete unused/tagging interfaces (e.g. StringPayloadGenerator, DefaultPayloadProcessor) and remove dead UI class-returning methods.
  • Update fuzzing handlers/dialogs/iterators to use the simplified types consistently (including HTTP and WebSocket fuzzers).

Reviewed changes

Copilot reviewed 94 out of 94 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
addOns/websocket/src/main/java/org/zaproxy/zap/extension/websocket/fuzz/WebSocketFuzzerHandler.java Update fuzzer creation to use non-generic PayloadGeneratorMessageLocation lists.
addOns/fuzz/src/test/java/org/zaproxy/zap/extension/fuzz/payloads/generator/JsonPayloadGeneratorUnitTest.java Update tests to iterate over Payload instead of DefaultPayload.
addOns/fuzz/src/test/java/org/zaproxy/zap/extension/fuzz/payloads/generator/FileStringPayloadGeneratorUnitTest.java Update tests to use Payload-typed iterators.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/URLEncodeProcessorUIHandler.java Remove UI generics and dead class-binding methods.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/URLDecodeProcessorUIHandler.java Remove UI generics and dead class-binding methods.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/TrimStringProcessorUIHandler.java Remove UI generics; adjust panel setter to accept PayloadProcessorUI.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/SHA512HashProcessorUIHandler.java Remove UI generics and dead class-binding methods.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/SHA256HashProcessorUIHandler.java Remove UI generics and dead class-binding methods.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/SHA1HashProcessorUIHandler.java Remove UI generics and dead class-binding methods.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/ScriptStringPayloadProcessorAdapterUIHandler.java Remove UI generics; update panel setter signature and casting.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/PrefixStringProcessorUIHandler.java Remove UI generics; adjust panel setter to accept PayloadProcessorUI.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/PostfixStringProcessorUIHandler.java Remove UI generics; adjust panel setter to accept PayloadProcessorUI.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/PayloadProcessorUIPanel.java Collapse generic UI panel interface to non-generic form.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/PayloadProcessorUIHandlersRegistry.java Simplify registry storage and registration API to non-generic types.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/PayloadProcessorUIHandler.java Simplify UI handler interface to non-generic types.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/PayloadProcessorUI.java Simplify UI interface to return non-generic PayloadProcessor.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/MD5HashProcessorUIHandler.java Remove UI generics and dead class-binding methods.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/JavaScriptUnescapeProcessorUIHandler.java Remove UI generics; update setter signature.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/JavaScriptEscapeProcessorUIHandler.java Remove UI generics; update setter signature.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/ExpandStringProcessorUIHandler.java Remove UI generics; update panel implementation to non-generic interface.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/Base64EncodeProcessorUIHandler.java Remove UI generics; adjust setter casting.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/Base64DecodeProcessorUIHandler.java Remove UI generics and dead class-binding methods.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/AbstractStringHashProcessorUIPanel.java Remove generics from base hash UI panel; update setter signature.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/AbstractProcessorUIPanel.java Simplify base UI panel class to non-generic interface.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/processors/AbstractCharsetProcessorUIPanel.java Remove generics from base charset UI panel; update setter signature.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/PayloadGeneratorUIPanel.java Collapse generator UI panel interface to non-generic form.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/PayloadGeneratorUIHandlersRegistry.java Simplify generator UI handlers registry to non-generic types.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/PayloadGeneratorUIHandler.java Simplify generator UI handler interface to non-generic types.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/PayloadGeneratorUI.java Simplify generator UI interface to return non-generic PayloadGenerator.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/ScriptStringPayloadGeneratorAdapterUIHandler.java Remove UI generics; update iterator types and setter casting.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/RegexPayloadGeneratorUIHandler.java Remove UI generics; update preview iterator type and setter signature.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/NumberPayloadGeneratorAdapterUIHandler.java Remove UI generics; update preview iterator type and setter signature.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/ModifyPayloadsPanel.java Remove generics from modify panel; use PayloadGenerator/Payload directly.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/JsonPayloadGeneratorAdapterUIHandler.java Remove UI generics; simplify panel interface usage.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java Remove UI generics; update preview iterator type and modify-panel plumbing.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/DefaultStringPayloadGeneratorUIHandler.java Remove UI generics; update panel setter signature and casting.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/DefaultEmptyPayloadGeneratorUIHandler.java Remove UI generics; adjust generator return types and base class usage.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/AbstractPersistentPayloadGeneratorUIPanel.java Remove panel generics; save-to-file iterates Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/URLEncodeProcessor.java Switch processor to PayloadProcessor and Payload parameters.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/URLDecodeProcessor.java Switch processor to PayloadProcessor and Payload parameters.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/TrimStringProcessor.java Switch processor to non-generic PayloadProcessor.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/ScriptStringPayloadProcessorAdapter.java Switch adapter to non-generic PayloadProcessor; update Javadoc.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/PrefixStringProcessor.java Switch processor to non-generic PayloadProcessor.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/PostfixStringProcessor.java Switch processor to non-generic PayloadProcessor.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/PayloadProcessor.java Remove generic type parameter; process/copy now use Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/JavaScriptUnescapeProcessor.java Switch processor to non-generic PayloadProcessor.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/JavaScriptEscapeProcessor.java Switch processor to non-generic PayloadProcessor.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/ExpandStringProcessor.java Switch processor to non-generic PayloadProcessor; update Javadoc.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/DefaultPayloadProcessor.java Deleted tagging interface no longer needed after API simplification.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/Base64EncodeProcessor.java Switch processor to Payload parameter/return types.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/Base64DecodeProcessor.java Switch processor to Payload parameter/return types.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/AbstractStringHashProcessor.java Switch base processor to Payload parameter/return types.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/processor/AbstractCharsetProcessor.java Remove generic parameter from base charset processor.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/PayloadMessageLocationReplacement.java Simplify replacement wrapper to directly hold Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/PayloadGeneratorMessageLocation.java Remove generic payload parameter; use Payload directly.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/PayloadCollectionIterator.java Remove generic parameter; iterate Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/StringPayloadGenerator.java Deleted tagging interface no longer needed after API simplification.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/ScriptStringPayloadGeneratorAdapter.java Switch adapter to non-generic PayloadGenerator; iterator returns Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/ScriptStringPayloadGenerator.java Update docs to reference PayloadGenerator instead of removed tagging type.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/RegexPayloadGenerator.java Switch generator to non-generic PayloadGenerator; iterator returns Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/ProcessPayloadGenerator.java Switch generator to non-generic PayloadGenerator; iterator returns Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/ProcessedPayloadGenerator.java Remove generic payload parameter; processors/generator lists are non-generic.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/PayloadGenerator.java Remove generic parameter; standardise iterable/iterator types to Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/NumberPayloadGenerator.java Switch generator/iterator interfaces to Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/JsonPayloadGenerator.java Switch generator to PayloadGenerator; iterator returns Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/FileStringPayloadGenerator.java Switch generator to PayloadGenerator; iterator returns Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/EmptyPayloadGenerator.java Remove generic parameter; repeat iterator yields Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/DefaultStringPayloadGenerator.java Switch internal storage/iterators to Payload instead of DefaultPayload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/generator/CompositePayloadGenerator.java Remove generic parameter; compose PayloadGenerator instances directly.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/ProcessorsPayloadDialog.java Remove generic plumbing around processor UIs and processors list types.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/ProcessorsMessageLocationDialog.java Remove generic plumbing around processor UIs and processors list types.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/PayloadTableEntry.java Simplify stored payload generator UI type to non-generic PayloadGeneratorUI.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/PayloadsProcessedIterator.java Remove generic payload parameter; process Payload directly.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/PayloadProcessorTableEntry.java Simplify stored processor UI type to non-generic PayloadProcessorUI.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/PayloadProcessorsContainer.java Remove generics; map UI class to non-generic processor panels.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/PayloadPreviewPanel.java Remove generics; preview processing uses non-generic PayloadProcessor.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/PayloadGeneratorsContainer.java Remove generics; map UI class to non-generic generator panels.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/ModifyProcessorDialog.java Remove generics from dialog; store/use non-generic processor UI/panel.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/ModifyPayloadDialog.java Remove generics from dialog; store/use non-generic generator UI/panel.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/MessageLocationPayloadsPanel.java Remove generics and casts around payload generator UI/dialog interactions.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/FuzzMessageLocationsPanel.java Use non-generic generator/processor wrappers; return non-generic fuzz locations list.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/FuzzerDialog.java Store/retrieve fuzz locations as non-generic PayloadGeneratorMessageLocation.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/AddProcessorDialog.java Remove generics; select/store non-generic processor UI/panel.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/impl/AddPayloadDialog.java Remove generics; select/store non-generic generator UI/panel.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/httpfuzzer/ui/HttpMessageSelectorPanel.java Remove redundant type args in Collections.emptyList() usage.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/httpfuzzer/HttpFuzzerHandler.java Update fuzzer creation to use non-generic PayloadGeneratorMessageLocation lists.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/httpfuzzer/HttpFuzzer.java Clean up Collections.emptyList() usage.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/FuzzerPayloadSource.java Switch payload source API from removed tagging generator type to PayloadGenerator.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/FuzzerPayloadJBroFuzzSource.java Switch JBroFuzz source generator/iterator types to PayloadGenerator/Payload.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/FuzzerPayloadGeneratorUIHandler.java Remove UI generics; update iterators and nested modify panel integration.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/FuzzerPayloadGenerator.java Switch composite generator to non-generic PayloadGenerator list.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/FuzzerPayloadFileSource.java Switch file payload source API to PayloadGenerator.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/ExtensionFuzz.java Clean up Collections.emptyList() usage in several places.
addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/AbstractFuzzer.java Clean up Collections.emptyList() usage.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@psiinon
Copy link
Copy Markdown
Member

psiinon commented Apr 7, 2026 •
edited
Loading

Logo
Checkmarx One – Scan Summary & Details – 19853920-702e-4a45-b5ec-eb2e1ceb638c

New Issues (158) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 CRITICAL Stored_Code_Injection /addOns/graaljs/src/main/java/org/zaproxy/zap/extension/graaljs/PacScript.java: 107
detailsThe application's  method receives and dynamically executes user-controlled code using eval, at line 143 of /addOns/graaljs/src/main/java/org/zapr...
Attack Vector
2 CRITICAL Stored_XSS /addOns/plugnhack/src/main/java/org/zaproxy/zap/extension/plugnhack/PlugNHackAPI.java: 300
detailsThe method embeds untrusted data in generated output with append, at line 301 of /addOns/plugnhack/src/main/java/org/zaproxy/zap/extension/plugnha...
Attack Vector
3 HIGH Absolute_Path_Traversal /addOns/selenium/src/main/java/org/zaproxy/zap/extension/selenium/internal/DialogCustomBrowser.java: 363
detailsMethod at line 363 of /addOns/selenium/src/main/java/org/zaproxy/zap/extension/selenium/internal/DialogCustomBrowser.java gets dynamic data from ...
Attack Vector
4 HIGH Absolute_Path_Traversal /addOns/selenium/src/main/java/org/zaproxy/zap/extension/selenium/internal/DialogCustomBrowser.java: 331
detailsMethod at line 331 of /addOns/selenium/src/main/java/org/zaproxy/zap/extension/selenium/internal/DialogCustomBrowser.java gets dynamic data from ...
Attack Vector
5 HIGH Absolute_Path_Traversal /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java: 423
detailsMethod at line 423 of /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java gets dy...
Attack Vector
6 HIGH Absolute_Path_Traversal /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java: 391
detailsMethod at line 391 of /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java gets dy...
Attack Vector
7 HIGH Absolute_Path_Traversal /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java: 605
detailsMethod at line 605 of /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java gets dy...
Attack Vector
8 HIGH Absolute_Path_Traversal /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java: 656
detailsMethod at line 656 of /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java gets dy...
Attack Vector
9 HIGH Absolute_Path_Traversal /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java: 432
detailsMethod at line 432 of /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java gets dy...
Attack Vector
10 HIGH Absolute_Path_Traversal /addOns/invoke/src/main/java/org/zaproxy/zap/extension/invoke/DialogAddApp.java: 335
detailsMethod at line 335 of /addOns/invoke/src/main/java/org/zaproxy/zap/extension/invoke/DialogAddApp.java gets dynamic data from the getText element...
Attack Vector
11 HIGH Absolute_Path_Traversal /addOns/invoke/src/main/java/org/zaproxy/zap/extension/invoke/DialogAddApp.java: 297
detailsMethod at line 297 of /addOns/invoke/src/main/java/org/zaproxy/zap/extension/invoke/DialogAddApp.java gets dynamic data from the getText element...
Attack Vector
12 HIGH Absolute_Path_Traversal /addOns/reports/src/main/java/org/zaproxy/addon/reports/ReportDialog.java: 153
detailsMethod at line 153 of /addOns/reports/src/main/java/org/zaproxy/addon/reports/ReportDialog.java gets dynamic data from the getText element. This...
Attack Vector
13 HIGH Absolute_Path_Traversal /addOns/network/src/main/java/org/zaproxy/addon/network/ClientCertificatesOptionsPanel.java: 206
detailsMethod at line 206 of /addOns/network/src/main/java/org/zaproxy/addon/network/ClientCertificatesOptionsPanel.java gets dynamic data from the getT...
Attack Vector
14 HIGH Absolute_Path_Traversal /addOns/jython/src/main/java/org/zaproxy/zap/extension/jython/JythonOptionsPanel.java: 111
detailsMethod at line 111 of /addOns/jython/src/main/java/org/zaproxy/zap/extension/jython/JythonOptionsPanel.java gets dynamic data from the getText el...
Attack Vector
15 HIGH Absolute_Path_Traversal /addOns/invoke/src/main/java/org/zaproxy/zap/extension/invoke/DialogAddApp.java: 223
detailsMethod at line 223 of /addOns/invoke/src/main/java/org/zaproxy/zap/extension/invoke/DialogAddApp.java gets dynamic data from the getText element...
Attack Vector
16 HIGH Absolute_Path_Traversal /addOns/network/src/main/java/org/zaproxy/addon/network/internal/ui/AddPkcs11DriverDialog.java: 96
detailsMethod at line 96 of /addOns/network/src/main/java/org/zaproxy/addon/network/internal/ui/AddPkcs11DriverDialog.java gets dynamic data from the ge...
Attack Vector
17 HIGH Cleartext_Submission_of_Sensitive_Information /addOns/network/src/main/java/org/zaproxy/addon/network/internal/client/apachev5/HttpSenderApache.java: 446
detailsPotentially sensitive personal information credentialsProvider, at line 446 of /addOns/network/src/main/java/org/zaproxy/addon/network/internal/cli...
Attack Vector
18 HIGH Improper_Restriction_of_Stored_XXE_Ref /addOns/reports/src/test/java/org/zaproxy/addon/reports/ReportTestUtils.java: 236
detailsThe loads and parses XML using parse, at line 452 of /addOns/reports/src/test/java/org/zaproxy/addon/reports/ExtensionReportsXmlUnitTest.java. ...
Attack Vector
19 HIGH Improper_Restriction_of_Stored_XXE_Ref /addOns/reports/src/test/java/org/zaproxy/addon/reports/ReportTestUtils.java: 236
detailsThe loads and parses XML using parse, at line 419 of /addOns/reports/src/test/java/org/zaproxy/addon/reports/ExtensionReportsXmlUnitTest.java. ...
Attack Vector
20 HIGH Improper_Restriction_of_Stored_XXE_Ref /addOns/reports/src/test/java/org/zaproxy/addon/reports/ReportTestUtils.java: 236
detailsThe loads and parses XML using parse, at line 386 of /addOns/reports/src/test/java/org/zaproxy/addon/reports/ExtensionReportsXmlUnitTest.java. ...
Attack Vector
21 HIGH Improper_Restriction_of_Stored_XXE_Ref /addOns/reports/src/test/java/org/zaproxy/addon/reports/ReportTestUtils.java: 236
detailsThe loads and parses XML using parse, at line 364 of /addOns/reports/src/test/java/org/zaproxy/addon/reports/ExtensionReportsXmlUnitTest.java. ...
Attack Vector
22 HIGH Improper_Restriction_of_Stored_XXE_Ref /addOns/todo/src/main/java/org/zaproxy/zap/extension/todo/TodoList.java: 131
detailsThe loads and parses XML using parse, at line 133 of /addOns/todo/src/main/java/org/zaproxy/zap/extension/todo/TodoList.java. This XML was rece...
Attack Vector
23 HIGH Improper_Restriction_of_Stored_XXE_Ref /addOns/saml/src/main/java/org/zaproxy/zap/extension/saml/SAMLConfiguration.java: 78
detailsThe loads and parses XML using unmarshal, at line 248 of /addOns/saml/src/main/java/org/zaproxy/zap/extension/saml/SAMLConfiguration.java. This...
Attack Vector
24 HIGH SSRF /addOns/network/src/main/java/org/zaproxy/addon/network/internal/client/LegacyUtils.java: 46
detailsThe application sends a request to a remote server, for some resource, using execute in /addOns/network/src/main/java/org/zaproxy/addon/network/int...
Attack Vector
25 HIGH SSRF /addOns/network/src/main/java/org/zaproxy/addon/network/internal/client/LegacyUtils.java: 56
detailsThe application sends a request to a remote server, for some resource, using execute in /addOns/network/src/main/java/org/zaproxy/addon/network/int...
Attack Vector
26 HIGH SSRF /addOns/network/src/main/java/org/zaproxy/addon/network/internal/client/LegacyUtils.java: 53
detailsThe application sends a request to a remote server, for some resource, using execute in /addOns/network/src/main/java/org/zaproxy/addon/network/int...
Attack Vector
27 HIGH SSRF /addOns/network/src/main/java/org/zaproxy/addon/network/internal/client/LegacyUtils.java: 47
detailsThe application sends a request to a remote server, for some resource, using execute in /addOns/network/src/main/java/org/zaproxy/addon/network/int...
Attack Vector
28 HIGH SSRF /addOns/network/src/main/java/org/apache/hc/client5/http/impl/classic/ZapInternalHttpClient.java: 188
detailsThe application sends a request to a remote server, for some resource, using execute in /addOns/network/src/main/java/org/apache/hc/client5/http/im...
Attack Vector
29 MEDIUM Missing_HSTS_Header /addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/HeartBleedActiveScanRule.java: 984
detailsThe web-application does not define an HSTS header, leaving it vulnerable to attack.
Attack Vector
30 MEDIUM Privacy_Violation /addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/LlmAppendHttpMessageMenu.java: 53
detailsMethod at line 53 of /addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/LlmAppendHttpMessageMenu.java sends user information outside the applicat...
Attack Vector
31 MEDIUM Privacy_Violation /addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmCommunicationService.java: 201
detailsMethod at line 201 of /addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmCommunicationService.java sends user information outside the ap...
Attack Vector
32 MEDIUM Privacy_Violation /addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/LlmChatPanel.java: 240
detailsMethod at line 240 of /addOns/llm/src/main/java/org/zaproxy/addon/llm/ui/LlmChatPanel.java sends user information outside the application. This ...
Attack Vector
33 MEDIUM Privacy_Violation /addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmCommunicationService.java: 206
detailsMethod at line 206 of /addOns/llm/src/main/java/org/zaproxy/addon/llm/services/LlmCommunicationService.java sends user information outside the ap...
Attack Vector

More results are available on the CxOne platform

Fixed Issues (5) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
MEDIUM Unchecked_Input_for_Loop_Condition /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/DefaultStringPayloadGeneratorUIHandler.java: 257
MEDIUM Unchecked_Input_for_Loop_Condition /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/RegexPayloadGeneratorUIHandler.java: 381
MEDIUM Unchecked_Input_for_Loop_Condition /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java: 612
MEDIUM Unchecked_Input_for_Loop_Condition /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/FileStringPayloadGeneratorUIHandler.java: 617
MEDIUM Unchecked_Input_for_Loop_Condition /addOns/fuzz/src/main/java/org/zaproxy/zap/extension/fuzz/payloads/ui/impl/JsonPayloadGeneratorAdapterUIHandler.java: 169

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

@ricekot ricekot force-pushed the fuzz/reduce-generics branch from d8ed030 to 41c7efa Compare April 8, 2026 06:54
@ricekot ricekot requested a review from Copilot April 8, 2026 06:57
Copilot AI reviewed Apr 8, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 94 out of 94 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@ricekot
fuzz: Reduce use of generics
a7c4dcb 
Remove generic type parameters that provided no real type safety:

- Remove <T extends Payload> from all interfaces, classes, and methods,
  replacing with the Payload interface in type declarations. DefaultPayload
  is the only implementation and no add-on ever used a custom payload type.

- Remove generic type parameters from the UI hierarchy:
  PayloadGeneratorUI, PayloadGeneratorUIHandler, PayloadGeneratorUIPanel,
  PayloadProcessorUI, PayloadProcessorUIHandler, PayloadProcessorUIPanel,
  and all abstract/concrete implementations. Every consumer already used
  wildcards or unchecked casts, so the generics added no safety.

- Remove dead getPayloadGeneratorClass() and getPayloadProcessorClass()
  methods from PayloadGeneratorUI and PayloadProcessorUI interfaces and
  all 23 implementations. These were never called anywhere in the codebase.

- Delete tagging interfaces StringPayloadGenerator and
  DefaultPayloadProcessor that existed solely to bind DefaultPayload
  into generic parents.

The <M extends Message> generics are preserved as the websocket add-on
depends on them with WebSocketMessageDTO.

Signed-off-by: ricekot <git@ricekot.com>
@ricekot ricekot force-pushed the fuzz/reduce-generics branch from 41c7efa to a7c4dcb Compare April 8, 2026 07:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@ricekot @psiinon