From 0313d887e1f4b2fc65014d97fa8016e369ccb9d3 Mon Sep 17 00:00:00 2001
From: Iesan Remus <iesanremus@Iesans-MacBook-Pro.local>
Date: Tue, 14 Oct 2025 16:33:07 +0300
Subject: [PATCH 1/3] Update tests/data/app/controllers.php

---
 tests/data/app/controllers.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/data/app/controllers.php b/tests/data/app/controllers.php
index 38b86e1856..dddb42ad1b 100755
--- a/tests/data/app/controllers.php
+++ b/tests/data/app/controllers.php
@@ -93,9 +93,9 @@ function GET($matches) {
     }
 
     function POST() {
-        setcookie('f', 'b', time() + 60, null, null, false, true);
-        setcookie('foo', 'bar1', time() + 60, null, 'sub.localhost', false, true);
-        setcookie('baz', 'bar2', time() + 60,  null, 'sub.localhost', false, true);
+        setcookie('f', 'b', time() + 60, null, null, true, true);
+        setcookie('foo', 'bar1', time() + 60, null, 'sub.localhost', true, true);
+        setcookie('baz', 'bar2', time() + 60,  null, 'sub.localhost', true, true);
         data::set('form', $_POST);
         include __DIR__.'/view/cookies.php';
     }
@@ -177,4 +177,4 @@ function GET() {
     function POST() {
         $this->GET();
     }
-}
\ No newline at end of file
+}

From 390940b368b0e952522040b636b424199619a76b Mon Sep 17 00:00:00 2001
From: Iesan Remus <iesanremus@Iesans-MacBook-Pro.local>
Date: Tue, 14 Oct 2025 16:33:07 +0300
Subject: [PATCH 2/3] Update tests/data/claypit/c3.php

---
 tests/data/claypit/c3.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/data/claypit/c3.php b/tests/data/claypit/c3.php
index 96720d95ad..48654d3f71 100644
--- a/tests/data/claypit/c3.php
+++ b/tests/data/claypit/c3.php
@@ -37,7 +37,7 @@ function __c3_error($message)
         if (!headers_sent()) {
             header('X-Codeception-CodeCoverage-Error: ' . str_replace("\n", ' ', $message), true, 500);
         }
-        setcookie('CODECEPTION_CODECOVERAGE_ERROR', $message);
+        setcookie('CODECEPTION_CODECOVERAGE_ERROR', $message, 0, '', '', true, true);
     }
 }
 
@@ -237,4 +237,4 @@ function () use ($codeCoverage, $current_report) {
     }
 }
 
-// @codeCoverageIgnoreEnd
\ No newline at end of file
+// @codeCoverageIgnoreEnd

From 0b5a9abd1793233bbc4c19c9014123271a3f2edf Mon Sep 17 00:00:00 2001
From: Iesan Remus <iesanremus@Iesans-MacBook-Pro.local>
Date: Tue, 14 Oct 2025 16:33:07 +0300
Subject: [PATCH 3/3] Update tests/unit/Codeception/Module/SoapTest.php

---
 tests/unit/Codeception/Module/SoapTest.php | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/tests/unit/Codeception/Module/SoapTest.php b/tests/unit/Codeception/Module/SoapTest.php
index 3d44ec23e8..e214596512 100644
--- a/tests/unit/Codeception/Module/SoapTest.php
+++ b/tests/unit/Codeception/Module/SoapTest.php
@@ -17,6 +17,16 @@ class SoapTest extends \PHPUnit_Framework_TestCase
 
     protected $layout;
 
+    private function createSecureDomDocument() {
+        if (LIBXML_VERSION < 20900 && function_exists('libxml_disable_entity_loader')) {
+            libxml_disable_entity_loader(true);
+        }
+        $dom = $this->createSecureDomDocument();
+        $dom->resolveExternals = false;
+        $dom->substituteEntities = false;
+        return $dom;
+    }
+
     public function setUp() {
         $this->module = new \Codeception\Module\SOAP();
         $this->module->_setConfig(['schema' => 'http://www.w3.org/2001/xml.xsd', 'endpoint' => 'http://codeception.com/api/wsdl']);
@@ -27,7 +37,7 @@ public function setUp() {
     }
     
     public function testXmlIsBuilt() {
-        $dom = new \DOMDocument();
+        $dom = $this->createSecureDomDocument();
         $dom->load($this->layout);
         $this->assertEqualXMLStructure($this->module->xmlRequest->documentElement, $dom->documentElement);
         $this->assertXmlStringEqualsXmlString($dom->saveXML(), $this->module->xmlRequest->saveXML());
@@ -35,7 +45,7 @@ public function testXmlIsBuilt() {
     
     public function testBuildHeaders() {
         $this->module->haveSoapHeader('AuthHeader', ['username' => 'davert', 'password' => '123456']);
-        $dom = new \DOMDocument();
+        $dom = $this->createSecureDomDocument();
         $dom->load($this->layout);
         $header = $dom->createElement('AuthHeader');
         $header->appendChild($dom->createElement('username','davert'));
@@ -48,7 +58,7 @@ public function testBuildRequest()
     {
         $this->module->sendSoapRequest('KillHumans', "<item><id>1</id><subitem>2</subitem></item>");
         $this->assertNotNull($this->module->xmlRequest);
-        $dom = new \DOMDocument();
+        $dom = $this->createSecureDomDocument();
         $dom->load($this->layout);
         $body = $dom->createElement('item');
         $body->appendChild($dom->createElement('id',1));
@@ -60,7 +70,7 @@ public function testBuildRequest()
     }
 
     public function testBuildRequestWithDomNode() {
-        $dom = new \DOMDocument();
+        $dom = $this->createSecureDomDocument();
         $dom->load($this->layout);
         $body = $dom->createElement('item');
         $body->appendChild($dom->createElement('id',1));