With an XML file that declares a DOCTYPE, take the struts.xml file for instance:
Does the Java SAX processing actually go get the dtd from the provided URL?
Many (most) implementations will, even though technically, if I remember correctly, the location is meant to be interpreted as a URI, not URL.
If you want to be sure to resolve it locally, take a look at the EntityResolver interface.