Path traversal bug in <Path /> parsing for Web Optimization

[jasperroel]

Recently we blew up our authoring environment because of a fun (what I perceive to be) bug.

Here's the steps to reproduce:
Create a new css/js alkacon-optiomized-css/js recource.
Make sure it has one Path element, and make sure it's empty (that's the default ).
Publish it, switch to the Online project.
Now, render the minified resource.

This defaults to recursively traversing the path from the site root if it's a folder (which it is, because the site root is always a folder).
Why? Because resolves to "", which then resolves to "/sites/[project default]/.

This takes forever and occupies about (at least) 180Mb of heap space for a long time (at least the duration of the call, plus caches etc) [in a system with hundreds of thousands of resources].
Multiple calls results in the same memory occupation (since the previous call is still running, caches aren't used). So, for a 32-bit JVM, after 8 hits the heap is exhausted and the system fails completely (OutOfMemoryExceptions and GCOverhead errors).

Solution
Stop this at the gate. as soon as includeDefault is called on the OptimizationBean, check "path" for an empty string. If it's empty, disallow/ignore it. An empty node is most possible a bug or at least unintentional.