diff --git a/pmd-core/src/main/java/net/sourceforge/pmd/cpd/internal/JavaCCTokenizer.java b/pmd-core/src/main/java/net/sourceforge/pmd/cpd/internal/JavaCCTokenizer.java
index 04b9ab04ef..cb3337c329 100644
--- a/pmd-core/src/main/java/net/sourceforge/pmd/cpd/internal/JavaCCTokenizer.java
+++ b/pmd-core/src/main/java/net/sourceforge/pmd/cpd/internal/JavaCCTokenizer.java
@@ -6,8 +6,7 @@ package net.sourceforge.pmd.cpd.internal;
 
 import java.io.IOException;
 import java.io.Reader;
-
-import org.apache.commons.io.input.CharSequenceReader;
+import java.io.StringReader;
 
 import net.sourceforge.pmd.cpd.SourceCode;
 import net.sourceforge.pmd.cpd.TokenEntry;
@@ -26,7 +25,7 @@ public abstract class JavaCCTokenizer implements Tokenizer {
 
     @SuppressWarnings("PMD.CloseResource")
     protected TokenManager<JavaccToken> getLexerForSource(SourceCode sourceCode) throws IOException {
-        Reader reader = IOUtil.skipBOM(new CharSequenceReader(sourceCode.getCodeBuffer()));
+        Reader reader = IOUtil.skipBOM(new StringReader(sourceCode.getCodeBuffer().toString()));
         return makeLexerImpl(makeCharStream(reader));
     }
 
diff --git a/pmd-core/src/main/java/net/sourceforge/pmd/lang/ast/impl/javacc/CharStreamFactory.java b/pmd-core/src/main/java/net/sourceforge/pmd/lang/ast/impl/javacc/CharStreamFactory.java
index f579c8a0a2..d7b456d4ba 100644
--- a/pmd-core/src/main/java/net/sourceforge/pmd/lang/ast/impl/javacc/CharStreamFactory.java
+++ b/pmd-core/src/main/java/net/sourceforge/pmd/lang/ast/impl/javacc/CharStreamFactory.java
@@ -8,9 +8,8 @@ import java.io.IOException;
 import java.io.Reader;
 import java.util.function.Function;
 
-import org.apache.commons.io.IOUtils;
-
 import net.sourceforge.pmd.lang.ast.CharStream;
+import net.sourceforge.pmd.util.IOUtil;
 
 public final class CharStreamFactory {
 
@@ -58,7 +57,7 @@ public final class CharStreamFactory {
     @Deprecated
     public static String toString(Reader dstream) {
         try (Reader r = dstream) {
-            return IOUtils.toString(r);
+            return IOUtil.readToString(r);
         } catch (IOException e) {
             throw new RuntimeException(e);
         }
diff --git a/pmd-core/src/main/java/net/sourceforge/pmd/util/datasource/DataSource.java b/pmd-core/src/main/java/net/sourceforge/pmd/util/datasource/DataSource.java
index 3338c64a8a..35231e6ba1 100644
--- a/pmd-core/src/main/java/net/sourceforge/pmd/util/datasource/DataSource.java
+++ b/pmd-core/src/main/java/net/sourceforge/pmd/util/datasource/DataSource.java
@@ -12,9 +12,7 @@ import java.io.Reader;
 import java.io.StringReader;
 import java.nio.charset.Charset;
 
-import org.apache.commons.io.ByteOrderMark;
-import org.apache.commons.io.IOUtils;
-import org.apache.commons.io.input.BOMInputStream;
+import net.sourceforge.pmd.util.IOUtil;
 
 /**
  * Represents a source file to be analyzed. Different implementations can get
@@ -59,10 +57,10 @@ public interface DataSource extends Closeable {
         String fullSource;
         try (InputStream stream = dataSource.getInputStream();
              // Skips the byte-order mark
-             BOMInputStream bomIs = new BOMInputStream(stream, ByteOrderMark.UTF_8, ByteOrderMark.UTF_16BE);
+             IOUtil.BomAwareInputStream bomIs = new IOUtil.BomAwareInputStream(stream);
              Reader reader = new InputStreamReader(bomIs, sourceEncoding)) {
 
-            fullSource = IOUtils.toString(reader); // this already buffers properly
+            fullSource = IOUtil.readToString(reader); // this already buffers properly
         }
         return fullSource;
     }
diff --git a/pmd-core/src/main/java/net/sourceforge/pmd/util/treeexport/TreeExportCli.java b/pmd-core/src/main/java/net/sourceforge/pmd/util/treeexport/TreeExportCli.java
index 9f6d1faaca..85985f62ef 100644
--- a/pmd-core/src/main/java/net/sourceforge/pmd/util/treeexport/TreeExportCli.java
+++ b/pmd-core/src/main/java/net/sourceforge/pmd/util/treeexport/TreeExportCli.java
@@ -16,7 +16,6 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
-import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang3.StringEscapeUtils;
 
 import net.sourceforge.pmd.annotation.Experimental;
@@ -32,6 +31,7 @@ import net.sourceforge.pmd.lang.ast.SemanticErrorReporter;
 import net.sourceforge.pmd.lang.rule.xpath.Attribute;
 import net.sourceforge.pmd.properties.PropertyDescriptor;
 import net.sourceforge.pmd.properties.PropertySource;
+import net.sourceforge.pmd.util.IOUtil;
 
 import com.beust.jcommander.DynamicParameter;
 import com.beust.jcommander.JCommander;
@@ -200,7 +200,7 @@ public class TreeExportCli {
         Slf4jSimpleConfiguration.disableLogging(Attribute.class);
 
         try {
-            String fullSource = IOUtils.toString(source);
+            String fullSource = IOUtil.readToString(source);
             ParserTask task = new ParserTask(langVersion, fileName, fullSource, SemanticErrorReporter.noop());
             RootNode root = parser.parse(task);
 
diff --git a/pmd-core/src/test/java/net/sourceforge/pmd/ant/PMDTaskTest.java b/pmd-core/src/test/java/net/sourceforge/pmd/ant/PMDTaskTest.java
index 4fa4b5fd8e..9707421d2c 100644
--- a/pmd-core/src/test/java/net/sourceforge/pmd/ant/PMDTaskTest.java
+++ b/pmd-core/src/test/java/net/sourceforge/pmd/ant/PMDTaskTest.java
@@ -22,7 +22,6 @@ import org.junit.contrib.java.lang.system.RestoreSystemProperties;
 import org.junit.rules.TestRule;
 
 import net.sourceforge.pmd.internal.Slf4jSimpleConfiguration;
-
 import net.sourceforge.pmd.util.IOUtil;
 
 public class PMDTaskTest {
diff --git a/pmd-core/src/test/java/net/sourceforge/pmd/cpd/FileReporterTest.java b/pmd-core/src/test/java/net/sourceforge/pmd/cpd/FileReporterTest.java
index 69768f7ecb..b7d2612554 100644
--- a/pmd-core/src/test/java/net/sourceforge/pmd/cpd/FileReporterTest.java
+++ b/pmd-core/src/test/java/net/sourceforge/pmd/cpd/FileReporterTest.java
@@ -12,9 +12,10 @@ import java.io.FileReader;
 import java.io.IOException;
 import java.io.Reader;
 
-import org.apache.commons.io.IOUtils;
 import org.junit.Test;
 
+import net.sourceforge.pmd.util.IOUtil;
+
 /**
  * @author Philippe T'Seyen
  */
@@ -56,7 +57,7 @@ public class FileReporterTest {
 
     private String readFile(File file) throws IOException {
         try (Reader reader = new FileReader(file)) {
-            String text = IOUtils.toString(reader);
+            String text = IOUtil.readToString(reader);
             return text.replaceAll("\\R", "\n");
         }
     }
diff --git a/pmd-html/src/main/java/net/sourceforge/pmd/lang/html/ast/HtmlParser.java b/pmd-html/src/main/java/net/sourceforge/pmd/lang/html/ast/HtmlParser.java
index 9042c90243..a2ce2533b0 100644
--- a/pmd-html/src/main/java/net/sourceforge/pmd/lang/html/ast/HtmlParser.java
+++ b/pmd-html/src/main/java/net/sourceforge/pmd/lang/html/ast/HtmlParser.java
@@ -19,5 +19,4 @@ public final class HtmlParser implements net.sourceforge.pmd.lang.ast.Parser {
         HtmlTreeBuilder builder = new HtmlTreeBuilder();
         return builder.build(doc, data, task, new HashMap<>());
     }
-    }
 }
diff --git a/pmd-test/src/main/java/net/sourceforge/pmd/test/util/JavaUtilLoggingRule.java b/pmd-test/src/main/java/net/sourceforge/pmd/test/util/JavaUtilLoggingRule.java
index d1f0cb8494..e801e7f8c5 100644
--- a/pmd-test/src/main/java/net/sourceforge/pmd/test/util/JavaUtilLoggingRule.java
+++ b/pmd-test/src/main/java/net/sourceforge/pmd/test/util/JavaUtilLoggingRule.java
@@ -9,6 +9,7 @@ import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsStringIgnoringCase;
 import static org.hamcrest.Matchers.emptyString;
 
+import java.io.ByteArrayOutputStream;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.List;
@@ -17,7 +18,6 @@ import java.util.logging.Handler;
 import java.util.logging.Logger;
 import java.util.logging.StreamHandler;
 
-import org.apache.commons.io.output.ByteArrayOutputStream;
 import org.junit.contrib.java.lang.system.SystemErrRule;
 import org.junit.rules.TestRule;
 import org.junit.runner.Description;
@@ -121,7 +121,7 @@ public class JavaUtilLoggingRule implements TestRule {
      */
     public String getLog() {
         customLogHandler.flush();
-        return stream.toString(StandardCharsets.UTF_8);
+        return new String(stream.toByteArray(), StandardCharsets.UTF_8);
     }
 
     /**