Find JNDI lookups that take remote input

Any Context.lookup or logging pattern that interpolates user data can be steered to a malicious LDAP or RMI server.