Repository: risingwavelabs/risingwave
File: src/common/src/util/batch_spill_config.rs (Rust)

Code before:
// Copyright 2026 RisingWave Labs
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

use std::path::Path;
use std::sync::LazyLock;

const RW_BATCH_SPILL_DIR_ENV: &str = "RW_BATCH_SPILL_DIR";
const DEFAULT_SPILL_DIR: &str = "/tmp";

/// Returns the base directory for spill (env value or default), without trailing slash.
pub fn batch_spill_base_dir() -> &'static Path {
    static BASE_DIR: LazyLock<String> = LazyLock::new(|| {
        std::env::var(RW_BATCH_SPILL_DIR_ENV).unwrap_or_else(|_| DEFAULT_SPILL_DIR.to_owned())
    });
    Path::new(&*BASE_DIR)
}


Review comment (performance):
`batch_spill_base_dir()` returns the raw `RW_BATCH_SPILL_DIR` value as a `Path` without validating it. Compared with the previous spill path construction (which effectively forced an absolute path by prefixing `/`), a relative or empty env value would now place spill data under the process working directory (and `clean_spill_directory()` would delete relative paths). Consider normalizing/validating the env value (e.g., trim, treat empty as default, and reject or convert relative paths) so spill locations are predictable and safe.
```suggestion
        let raw = std::env::var(RW_BATCH_SPILL_DIR_ENV).unwrap_or_else(|_| DEFAULT_SPILL_DIR.to_owned());
        let trimmed = raw.trim();
        // Treat empty (or whitespace-only) value as using the default.
        let dir = if trimmed.is_empty() {
            DEFAULT_SPILL_DIR
        } else {
            trimmed
        };
        // Ensure we always use an absolute path for the spill dir.
        // If a relative path is provided, convert it to an absolute path by prefixing `/`,
        // which matches the previous behavior that effectively forced absolute paths.
        if Path::new(dir).is_absolute() {
            dir.to_owned()
        } else {
            format!("/{}", dir.trim_start_matches('/'))
        }
```

Code after:
// Copyright 2026 RisingWave Labs
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

use std::path::{Path, PathBuf};
use std::sync::LazyLock;

const RW_BATCH_SPILL_DIR_ENV: &str = "RW_BATCH_SPILL_DIR";
const DEFAULT_SPILL_DIR: &str = "/tmp";

/// Returns the base directory for spill (env value or default)
pub fn batch_spill_base_dir() -> &'static Path {
    static BASE_DIR: LazyLock<PathBuf> = LazyLock::new(|| {
        let raw =
            std::env::var(RW_BATCH_SPILL_DIR_ENV).unwrap_or_else(|_| DEFAULT_SPILL_DIR.to_owned());
        let mut dir = PathBuf::from(raw.trim());
        if dir.is_relative() {
            dir = std::env::current_dir().unwrap().join(dir);
        }
        dir
    });
    BASE_DIR.as_path()
}