...
This compliant solution uses an init() method to create the webDigester. The explicit webDigester.getParser() call causes the newInstance() method to be invoked using the container's class loader instead of the context class loader (WebAppClassLoader). This is because the flag useContextClassLoader is not set set during initialization which captures the container's class loader at that time to define the Digester (the context class loader is the container's class loader at this point). The Later, even if the Tomcat server would still use uses the WebappClassLoader to create the parser instance when attempting to process the web.xml and other files, however, the explicit call to getParser() in init() ensures that the default parser is set during prior initialization and is impossible to replace. Because this is a one-time setting, future attempts to change the parser are futile.
...