CVE-2025-43745: Liferay Portal CSRF Vulnerability via Endpoint Parameter

The vulnerability is a classic CSRF issue where the application fails to validate the origin of a request. The provided commits clearly show that the APIGUI.js component was modified to fix this issue. Specifically, the useEffect hook within this component was changed to correctly parse the origin of the URL from the endpoint parameter. The original implementation was flawed, allowing an attacker to craft a malicious URL that would be processed by the application, leading to unauthorized actions. The patch addresses this by using the URL API to reliably extract the origin, ensuring that only requests from trusted sources are processed. The addition of a functional test in a separate commit further confirms that the fix is effective. Therefore, the APIGUI component is the primary vulnerable function, and the useEffect hook is the specific location of the vulnerability.