Invalid barcodes return random products

[teolemon]

https://world.openfoodfacts.org/api/v0/product/random.json

[hangy]

It's not actually random. The JSON is a bit confusing, because the order of properties seems to be randomized every time, but when you use the XML version, you see that it's always the same "product" - even for different alphanumeric product codes:

• https://world.openfoodfacts.org/api/v1/product/random.xml
• https://world.openfoodfacts.org/api/v1/product/random-foo-bar.xml

But not for

• https://world.openfoodfacts.org/api/v1/product/66456546546546.xml => not found
• https://world.openfoodfacts.org/api/v1/product/2347324kjk.xml => not found
• https://world.openfoodfacts.org/api/v1/product/2asdasdkjk.xml => completely different "product"
• https://world.openfoodfacts.org/api/v1/product/234asdasdkjksdfdsf.xml => not found

Unrelated, but weird, too:

• https://world.openfoodfacts.org/api/v5/xvxcv/random.xml => Works! (Weird version; No "product" resource?)

I think the main issue with "random" working is, that a product without a code exists in the products directory. There's probably a .sto file without an actual name of the file there. The reason why https://world.openfoodfacts.org/api/v1/product/2asdasdkjk.xml is found in normalize_code:

openfoodfacts-server/lib/ProductOpener/Products.pm

Line 87 in 5558ed8

$code =~ s/\D//g; # Keep only digits, remove spaces, dashes and everything else

We may want the API to be more strict about this.