title: Is dynamic importing with React lazy or NextJS dynamic vulnerable to injection
body: <p>React <code>lazy</code></p>
  
  <pre><code>const Component = lazy(() =&gt; import(`../${element}`));
  </code></pre>
  
  <p>NextJS <code>dynamic</code></p>
  
  <pre><code>const Component = dynamic(() =&gt; import(`../${element}`));
  </code></pre>
  
  <p>These examples have a relative path. However, in my app I also lazy load with element as the only argument to the import function e.g.</p>
  
  <pre><code>const Component = lazy(() =&gt; import(element));
  </code></pre>
  
  <p>Can element be tampered with for injection of XSS? and if so how can I protect against it. Is there a way to encode the variable to ensure it is safe?</p>