graphql injection party #31