Consolidating code ql findings (#2920)

* Consolidating code ql findings

* Added ref files for backstop to set baseline for removing custom js file

* Potential fix for code scanning alert no. 32: URL redirection from remote source

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Removed unused large file

* Fixed import order

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

app/main/views/templates.py

@@ -1,4 +1,5 @@
 from functools import partial
+from urllib.parse import urlparse
 
 from flask import abort, flash, jsonify, redirect, render_template, request, url_for
 from flask_login import current_user
@@ -194,7 +195,19 @@ def process_folder_management_form(form, current_folder_id):
             ids_to_move=form.templates_and_folders.data, move_to=move_to_id
         )
 
-    return redirect(request.url)
+    # Use request.full_path which includes query string but not host
+    # This avoids host header injection while preserving all parameters
+    # Hardened redirect: only allow relative URLs, and strip any backslashes
+    target = request.full_path.replace('\\', '')
+    parts = urlparse(target)
+    if not parts.scheme and not parts.netloc and target.startswith('/'):
+        return redirect(target)
+    # Fallback to main template list for this service
+    return redirect(url_for(
+        '.choose_template',
+        service_id=current_service.id,
+        template_type='all'
+    ))
 
 
 def get_template_nav_label(value):