Currently, the constructor for ValidatorResources takes an InputStream, and array of InputStream, a single String, or an array of Strings (in the latter two cases, the strings are assumed to be URIs of either webapp resources or classpath resources to be parsed). In a web application environment, a framework or application using Commons Validator will typically use either ServletContext.getResource() or Class.getResource() to find URLs of the set of resources to be configured.
However, the CommonsValidator constructor cannot take URLs correctly. Therefore, the caller will need to convert these URLs to external (String) form in order to pass them in. However, these Strings will ultimately need to be turned back into URLs anyway (inside the Digester instance being used), in order for relative references to work.
Thus, the current implementation assumes that there is a lossless conversion from a URL returned by ServletContext.getResource() or Class.getResource(), to a String, and then back to a URL. That assumption is not necessarily guaranteed for the servlet context resources (although it is generally the case in practice for most containers). It is legal for the container to embed information (such as a custom URLStreamHandler implementation) inside the URLs it returns for webapp resources.
It would be better defensive coding for ValidatorResources to accept an array of URLs of the resources to be loaded (and pass them directly in to Digester unchanged), in addition to the other constructors that are currently supported.