fix: sanitise query strings for earn modal interactions

[sergiubreban]

✅ Checklist

• npx changeset was attached.
• Covered by automatic tests. We couldn't find the original requirement for this part of the code, and I scanned the Earn project for all uses. I found out that only internal ledger domain URLs should trigger this functionality. Everything looks fine from my tests. We should try all the use-cases for this modal interaction to ensure no regression.
• Impact of the changes: - there should be no impact for the regular user. The attackers will be blocked if trying to use a malicious url in the query params (anything other than ledger domains | protocol)
  • ...

📝 Description

Validate and whitelist incoming deeplink inputs to prevent misuse while preserving legitimate functionality. details and example of malicious request can be found in the ticket

❓ Context

• JIRA or GitHub link: LIVE-20345

---

🧐 Checklist for the PR Reviewers

• The code aligns with the requirements described in the linked JIRA or GitHub issue.
• The PR description clearly documents the changes made and explains any technical trade-offs or design decisions.
• There are no undocumented trade-offs, technical debt, or maintainability issues.
• The PR has been tested thoroughly, and any potential edge cases have been considered and handled.
• Any new dependencies have been justified and documented.
• Performance considerations have been taken into account. (changes have been profiled or benchmarked if necessary)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

4 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
ledger-live-github-bot	Ignored	Preview		Sep 1, 2025 2:30pm
native-ui-storybook	Ignored	Preview		Sep 1, 2025 2:30pm
react-ui-storybook	Ignored	Preview		Sep 1, 2025 2:30pm
web-tools	Ignored	Preview		Sep 1, 2025 2:30pm

[beths-ledger]

Looks generally good but I have some concern about the max length requirements - is max length required for the tooltips?

[beths-ledger]

nice

[sentry-io]

Suspect Issues

This pull request was deployed and Sentry observed the following issues:

• ‼️ Sentry.withScope$argument_0 in production

_{Did you find this useful? React with a 👍 or 👎}