Force display_errors

Author: mnapoli

src/FpmRuntime/FpmHandler.php

@@ -78,7 +78,15 @@ public function start(): void
          * --force-stderr: force logs to be sent to stderr, which will allow us to send them to CloudWatch
          * TODO set `max_execution_time` to the timeout of the Lambda function?
          */
-        $resource = @proc_open(['php-fpm', '--nodaemonize', '--force-stderr', '--fpm-config', $this->configFile], [], $pipes);
+        $resource = @proc_open([
+            'php-fpm',
+            '--nodaemonize',
+            '--force-stderr',
+            '--fpm-config', $this->configFile,
+            // Override ini settings to force disabling display_errors
+            // Displaying errors in the HTTP response is a security risk
+            '-d', 'display_errors=0',
+        ], [], $pipes);
 
         if (! is_resource($resource)) {
             throw new RuntimeException('PHP-FPM failed to start');