The vulnerability stems from the getNameFromRequest() method's lack of input sanitization. The commit diff shows the patched version adds InputHelper::clean() to sanitize the 'name' parameter, confirming this was the attack vector. Since this function directly handles user-controlled input used in dashboard notifications (a context where XSS would execute), and the patch specifically addresses this method, we can conclusively identify it as the vulnerable function.