Merge branch 'replace-commons-io' into pmd7-replace-commons-io

Gemfile.lock

@@ -68,14 +68,14 @@ GEM
     multipart-post (2.1.1)
     nap (1.1.0)
     no_proxy_fix (0.1.2)
-    nokogiri (1.13.5)
+    nokogiri (1.13.6)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     octokit (4.22.0)
       faraday (>= 0.9)
       sawyer (~> 0.8.0, >= 0.5.3)
     open4 (1.3.4)
-    pmdtester (1.5.0)
+    pmdtester (1.5.1)
       differ (~> 0.1)
       liquid (~> 5.2)
       logger-colors (~> 1.0)

docs/Gemfile.lock

@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (6.0.4.8)
+    activesupport (6.0.5)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -232,7 +232,7 @@ GEM
       jekyll-seo-tag (~> 2.1)
     minitest (5.15.0)
     multipart-post (2.1.1)
-    nokogiri (1.13.5)
+    nokogiri (1.13.6)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     octokit (4.22.0)

docs/pages/release_notes.md

@@ -20,7 +20,8 @@ This is a {{ site.pmd.release_type }} release.
 ### New and noteworthy
 
 ### Fixed Issues
-
+* core
+  * [#3942](https://github.com/pmd/pmd/issues/3942): \[core] common-io path traversal vulnerability (CVE-2021-29425)
 * javascript
   * [#3948](https://github.com/pmd/pmd/issues/3948): \[js] Invalid operator error for method property in object literal
 

pmd-apex/pom.xml

@@ -61,10 +61,6 @@
         </dependency>
 
 
-        <dependency>
-            <groupId>commons-io</groupId>
-            <artifactId>commons-io</artifactId>
-        </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>

pmd-core/pom.xml

@@ -91,10 +91,6 @@
             <groupId>com.beust</groupId>
             <artifactId>jcommander</artifactId>
         </dependency>
-        <dependency>
-            <groupId>commons-io</groupId>
-            <artifactId>commons-io</artifactId>
-        </dependency>
 
         <dependency>
             <groupId>net.sf.saxon</groupId>

pmd-core/src/main/java/net/sourceforge/pmd/RuleSetWriter.java

@@ -21,7 +21,6 @@ import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
-import org.apache.commons.io.IOUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.w3c.dom.CDATASection;
@@ -37,6 +36,7 @@ import net.sourceforge.pmd.lang.rule.XPathRule;
 import net.sourceforge.pmd.properties.PropertyDescriptor;
 import net.sourceforge.pmd.properties.PropertyDescriptorField;
 import net.sourceforge.pmd.properties.PropertyTypeId;
+import net.sourceforge.pmd.util.IOUtil;
 
 /**
  * This class represents a way to serialize a RuleSet to an XML configuration
@@ -62,7 +62,7 @@ public class RuleSetWriter {
     }
 
     public void close() {
-        IOUtils.closeQuietly(outputStream);
+        IOUtil.closeQuietly(outputStream);
     }
 
     public void write(RuleSet ruleSet) {

pmd-core/src/main/java/net/sourceforge/pmd/ant/Formatter.java

@@ -18,7 +18,6 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Properties;
 
-import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.reflect.FieldUtils;
 import org.apache.commons.lang3.reflect.MethodUtils;
@@ -32,6 +31,7 @@ import net.sourceforge.pmd.renderers.Renderer;
 import net.sourceforge.pmd.renderers.RendererFactory;
 import net.sourceforge.pmd.reporting.FileAnalysisListener;
 import net.sourceforge.pmd.reporting.GlobalAnalysisListener;
+import net.sourceforge.pmd.util.IOUtil;
 import net.sourceforge.pmd.util.datasource.DataSource;
 
 @InternalApi
@@ -190,8 +190,8 @@ public class Formatter {
             isOnError = false;
         } finally {
             if (isOnError) {
-                IOUtils.closeQuietly(output);
-                IOUtils.closeQuietly(writer);
+                IOUtil.closeQuietly(output);
+                IOUtil.closeQuietly(writer);
             }
         }
         return writer;

pmd-core/src/main/java/net/sourceforge/pmd/cache/AbstractAnalysisCache.java

@@ -21,7 +21,6 @@ import java.util.List;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 
-import org.apache.commons.io.FilenameUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -35,6 +34,7 @@ import net.sourceforge.pmd.benchmark.TimedOperation;
 import net.sourceforge.pmd.benchmark.TimedOperationCategory;
 import net.sourceforge.pmd.cache.internal.ClasspathFingerprinter;
 import net.sourceforge.pmd.reporting.FileAnalysisListener;
+import net.sourceforge.pmd.util.IOUtil;
 import net.sourceforge.pmd.util.datasource.DataSource;
 
 /**
@@ -181,7 +181,7 @@ public abstract class AbstractAnalysisCache implements AnalysisCache {
             @Override
             public FileVisitResult visitFile(final Path file,
                     final BasicFileAttributes attrs) throws IOException {
-                String extension = FilenameUtils.getExtension(file.toString());
+                String extension = IOUtil.getFilenameExtension(file.toString());
                 if ("jar".equalsIgnoreCase(extension)) {
                     fileVisitor.visitFile(file, attrs);
                 }

pmd-core/src/main/java/net/sourceforge/pmd/cache/AnalysisResult.java

@@ -13,10 +13,9 @@ import java.util.List;
 import java.util.zip.Adler32;
 import java.util.zip.CheckedInputStream;
 
-import org.apache.commons.io.IOUtils;
-
 import net.sourceforge.pmd.RuleViolation;
 import net.sourceforge.pmd.annotation.InternalApi;
+import net.sourceforge.pmd.util.IOUtil;
 
 /**
  * The result of a single file analysis.
@@ -45,8 +44,7 @@ public class AnalysisResult {
                 new BufferedInputStream(Files.newInputStream(sourceFile.toPath())), new Adler32());
         ) {
             // Just read it, the CheckedInputStream will update the checksum on it's own
-            IOUtils.skipFully(stream, sourceFile.length());
-
+            IOUtil.skipFully(stream, sourceFile.length());
             return stream.getChecksum().getValue();
         } catch (final IOException ignored) {
             // We don't really care, if it's unreadable

pmd-core/src/main/java/net/sourceforge/pmd/cache/internal/RawFileFingerprinter.java

@@ -13,10 +13,11 @@ import java.util.Set;
 import java.util.zip.CheckedInputStream;
 import java.util.zip.Checksum;
 
-import org.apache.commons.io.IOUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import net.sourceforge.pmd.util.IOUtil;
+
 /**
  * Base fingerprinter for raw files.
  */
@@ -41,7 +42,7 @@ public class RawFileFingerprinter implements ClasspathEntryFingerprinter {
     public void fingerprint(URL entry, Checksum checksum) throws IOException {
         try (CheckedInputStream inputStream = new CheckedInputStream(entry.openStream(), checksum)) {
             // Just read it, the CheckedInputStream will update the checksum on it's own
-            while (IOUtils.skip(inputStream, Long.MAX_VALUE) == Long.MAX_VALUE) {
+            while (IOUtil.skipFully(inputStream, Long.MAX_VALUE) == Long.MAX_VALUE) {
                 // just loop
             }
         } catch (final FileNotFoundException ignored) {

pmd-core/src/main/java/net/sourceforge/pmd/cpd/CPD.java

@@ -15,13 +15,13 @@ import java.util.Map;
 import java.util.Set;
 import java.util.TreeMap;
 
-import org.apache.commons.io.FilenameUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import net.sourceforge.pmd.annotation.Experimental;
 import net.sourceforge.pmd.lang.ast.TokenMgrError;
 import net.sourceforge.pmd.util.FileFinder;
+import net.sourceforge.pmd.util.IOUtil;
 import net.sourceforge.pmd.util.database.DBMSMetadata;
 import net.sourceforge.pmd.util.database.DBURI;
 import net.sourceforge.pmd.util.database.SourceObject;
@@ -93,8 +93,7 @@ public class CPD {
             current.add(signature);
         }
 
-        if (!FilenameUtils.equalsNormalizedOnSystem(file.getAbsoluteFile().getCanonicalPath(),
-                file.getAbsolutePath())) {
+        if (!IOUtil.equalsNormalizedPaths(file.getAbsoluteFile().getCanonicalPath(), file.getAbsolutePath())) {
             System.err.println("Skipping " + file + " since it appears to be a symlink");
             return;
         }

pmd-core/src/main/java/net/sourceforge/pmd/cpd/SourceCode.java

@@ -14,8 +14,7 @@ import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.List;
 
-import org.apache.commons.io.ByteOrderMark;
-import org.apache.commons.io.input.BOMInputStream;
+import net.sourceforge.pmd.util.IOUtil;
 
 public class SourceCode {
 
@@ -112,11 +111,10 @@ public class SourceCode {
 
         @Override
         public Reader getReader() throws Exception {
-            BOMInputStream inputStream = new BOMInputStream(Files.newInputStream(file.toPath()), ByteOrderMark.UTF_8,
-                    ByteOrderMark.UTF_16BE, ByteOrderMark.UTF_16LE);
+            IOUtil.BomAwareInputStream inputStream = new IOUtil.BomAwareInputStream(Files.newInputStream(file.toPath()));
 
-            if (inputStream.hasBOM()) {
-                encoding = inputStream.getBOMCharsetName();
+            if (inputStream.hasBom()) {
+                encoding = inputStream.getBomCharsetName();
             }
             return new InputStreamReader(inputStream, encoding);
         }

pmd-core/src/main/java/net/sourceforge/pmd/document/DocumentFile.java

@@ -19,10 +19,11 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Scanner;
 
-import org.apache.commons.io.IOUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import net.sourceforge.pmd.util.IOUtil;
+
 /**
  * Implementation that handles a Document as a file in the filesystem and receives operations in a sorted manner
  * (i.e. the regions are sorted). This improves the efficiency of reading the file by only scanning it once while
@@ -159,7 +160,7 @@ public class DocumentFile implements Document, Closeable {
     }
 
     private void writeUntilEOF() throws IOException {
-        IOUtils.copy(reader, writer);
+        IOUtil.copy(reader, writer);
     }
 
     /* package-private */ List<Integer> getLineToOffset() {

pmd-core/src/main/java/net/sourceforge/pmd/internal/util/FileCollectionUtil.java

@@ -15,7 +15,6 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Set;
 
-import org.apache.commons.io.IOUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -24,6 +23,7 @@ import net.sourceforge.pmd.lang.Language;
 import net.sourceforge.pmd.lang.document.FileCollector;
 import net.sourceforge.pmd.lang.document.TextFile;
 import net.sourceforge.pmd.util.FileUtil;
+import net.sourceforge.pmd.util.IOUtil;
 import net.sourceforge.pmd.util.database.DBMSMetadata;
 import net.sourceforge.pmd.util.database.DBURI;
 import net.sourceforge.pmd.util.database.SourceObject;
@@ -166,7 +166,7 @@ public final class FileCollectionUtil {
                 LOG.trace("Adding database source object {}", falseFilePath);
 
                 try (Reader sourceCode = dbmsMetadata.getSourceCode(sourceObject)) {
-                    String source = IOUtils.toString(sourceCode);
+                    String source = IOUtil.readToString(sourceCode);
                     collector.addSourceFile(source, falseFilePath);
                 } catch (SQLException ex) {
                     collector.getReporter().warnEx("Cannot get SourceCode for {}  - skipping ...",

pmd-core/src/main/java/net/sourceforge/pmd/lang/document/NioTextFile.java

@@ -12,11 +12,10 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Objects;
 
-import org.apache.commons.io.IOUtils;
-
 import net.sourceforge.pmd.annotation.Experimental;
 import net.sourceforge.pmd.internal.util.AssertionUtil;
 import net.sourceforge.pmd.lang.LanguageVersion;
+import net.sourceforge.pmd.util.IOUtil;
 import net.sourceforge.pmd.util.datasource.DataSource;
 import net.sourceforge.pmd.util.datasource.FileDataSource;
 
@@ -68,7 +67,7 @@ class NioTextFile implements TextFile {
         }
 
         try (BufferedReader br = Files.newBufferedReader(path, charset)) {
-            return IOUtils.toString(br);
+            return IOUtil.readToString(br);
         }
     }
 

pmd-core/src/main/java/net/sourceforge/pmd/renderers/AbstractRenderer.java

@@ -9,8 +9,6 @@ import java.io.Writer;
 import java.util.Collections;
 import java.util.List;
 
-import org.apache.commons.io.IOUtils;
-
 import net.sourceforge.pmd.PMDConfiguration;
 import net.sourceforge.pmd.annotation.Experimental;
 import net.sourceforge.pmd.cli.PMDParameters;
@@ -113,7 +111,7 @@ public abstract class AbstractRenderer extends AbstractPropertySource implements
         } catch (IOException e) {
             throw new IllegalStateException(e);
         } finally {
-            IOUtils.closeQuietly(writer);
+            IOUtil.closeQuietly(writer);
         }
     }
 

pmd-core/src/main/java/net/sourceforge/pmd/renderers/XMLRenderer.java

@@ -22,7 +22,6 @@ import javax.xml.stream.XMLOutputFactory;
 import javax.xml.stream.XMLStreamException;
 import javax.xml.stream.XMLStreamWriter;
 
-import org.apache.commons.io.output.WriterOutputStream;
 import org.apache.commons.lang3.StringUtils;
 
 import net.sourceforge.pmd.PMDVersion;
@@ -30,6 +29,7 @@ import net.sourceforge.pmd.Report;
 import net.sourceforge.pmd.RuleViolation;
 import net.sourceforge.pmd.properties.PropertyDescriptor;
 import net.sourceforge.pmd.properties.PropertyFactory;
+import net.sourceforge.pmd.util.IOUtil;
 import net.sourceforge.pmd.util.StringUtil;
 
 /**
@@ -258,7 +258,7 @@ public class XMLRenderer extends AbstractIncrementingRenderer {
     public void setWriter(final Writer writer) {
         String encoding = getProperty(ENCODING);
         // for backwards compatibility, create a OutputStream that writes to the writer.
-        this.stream = new WriterOutputStream(writer, encoding);
+        this.stream = IOUtil.fromWriter(writer, encoding);
 
         XMLOutputFactory outputFactory = XMLOutputFactory.newFactory();
         try {

pmd-core/src/main/java/net/sourceforge/pmd/util/FileFinder.java

@@ -8,10 +8,9 @@ import java.io.File;
 import java.io.FilenameFilter;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Comparator;
 import java.util.List;
 
-import org.apache.commons.io.comparator.PathFileComparator;
-
 import net.sourceforge.pmd.annotation.InternalApi;
 
 /**
@@ -49,7 +48,12 @@ public class FileFinder {
             return;
         }
 
-        Arrays.sort(candidates, PathFileComparator.PATH_INSENSITIVE_COMPARATOR);
+        Arrays.sort(candidates, new Comparator<File>() {
+            @Override
+            public int compare(File o1, File o2) {
+                return o1.getPath().compareToIgnoreCase(o2.getPath());
+            }
+        });
 
         for (File tmp : candidates) {
             if (tmp.isDirectory()) {

pmd-core/src/main/java/net/sourceforge/pmd/util/FileUtil.java

@@ -23,7 +23,6 @@ import java.util.regex.Pattern;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
 
-import org.apache.commons.io.FileUtils;
 import org.apache.commons.lang3.StringUtils;
 
 import net.sourceforge.pmd.annotation.InternalApi;
@@ -183,7 +182,7 @@ public final class FileUtil {
      * @throws IOException if the file couldn't be read
      */
     public static String readFilelist(File filelist) throws IOException {
-        String filePaths = FileUtils.readFileToString(filelist);
+        String filePaths = IOUtil.readFileToString(filelist);
         filePaths = StringUtils.trimToEmpty(filePaths);
         filePaths = filePaths.replaceAll("\\r?\\n", ",");
         filePaths = filePaths.replaceAll(",+", ",");

pmd-core/src/main/java/net/sourceforge/pmd/util/datasource/ReaderDataSource.java

@@ -8,8 +8,7 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.io.Reader;
 
-import org.apache.commons.io.input.ReaderInputStream;
-
+import net.sourceforge.pmd.util.IOUtil;
 import net.sourceforge.pmd.util.datasource.internal.AbstractDataSource;
 
 /**
@@ -50,7 +49,7 @@ public class ReaderDataSource extends AbstractDataSource {
      */
     @Override
     public InputStream getInputStream() throws IOException {
-        return new ReaderInputStream(reader);
+        return IOUtil.fromReader(reader);
     }
 
     /**

pmd-core/src/test/java/net/sourceforge/pmd/RuleSetReferenceIdTest.java

@@ -22,9 +22,9 @@ import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.util.List;
 
-import org.apache.commons.io.IOUtils;
 import org.junit.Test;
 
+import net.sourceforge.pmd.util.IOUtil;
 import net.sourceforge.pmd.util.ResourceLoader;
 
 import com.github.tomakehurst.wiremock.junit.WireMockRule;
@@ -123,7 +123,7 @@ public class RuleSetReferenceIdTest {
         assertRuleSetReferenceId(true, rulesetUrl, true, null, rulesetUrl, ruleSetReferenceId);
 
         try (InputStream inputStream = ruleSetReferenceId.getInputStream(new ResourceLoader())) {
-            String loaded = IOUtils.toString(inputStream, StandardCharsets.UTF_8);
+            String loaded = IOUtil.readToString(inputStream, StandardCharsets.UTF_8);
             assertEquals("xyz", loaded);
         }
 
@@ -139,8 +139,8 @@ public class RuleSetReferenceIdTest {
         String path = "/profiles/export?format=pmd&language=java&name=Sonar%2520way";
         String completePath = path + "/DummyBasicMockRule";
         String hostpart = "http://localhost:" + wireMockRule.port();
-        String basicRuleSet = IOUtils
-                .toString(RuleSetReferenceId.class.getResourceAsStream("/rulesets/dummy/basic.xml"), StandardCharsets.UTF_8);
+        String basicRuleSet = IOUtil
+                .readToString(RuleSetReferenceId.class.getResourceAsStream("/rulesets/dummy/basic.xml"), StandardCharsets.UTF_8);
 
         stubFor(head(urlEqualTo(completePath)).willReturn(aResponse().withStatus(404)));
         stubFor(head(urlEqualTo(path)).willReturn(aResponse().withStatus(200).withHeader("Content-type", "text/xml")));
@@ -152,7 +152,7 @@ public class RuleSetReferenceIdTest {
                 ruleSetReferenceId);
 
         try (InputStream inputStream = ruleSetReferenceId.getInputStream(new ResourceLoader())) {
-            String loaded = IOUtils.toString(inputStream, StandardCharsets.UTF_8);
+            String loaded = IOUtil.readToString(inputStream, StandardCharsets.UTF_8);
             assertEquals(basicRuleSet, loaded);
         }
 

pmd-core/src/test/java/net/sourceforge/pmd/RuleSetTest.java

@@ -30,7 +30,6 @@ import java.util.Set;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
-import org.apache.commons.io.FilenameUtils;
 import org.checkerframework.checker.nullness.qual.NonNull;
 import org.junit.Test;
 
@@ -45,6 +44,7 @@ import net.sourceforge.pmd.lang.ast.Node;
 import net.sourceforge.pmd.lang.ast.RootNode;
 import net.sourceforge.pmd.lang.rule.RuleReference;
 import net.sourceforge.pmd.lang.rule.RuleTargetSelector;
+import net.sourceforge.pmd.util.IOUtil;
 
 public class RuleSetTest {
 
@@ -523,7 +523,7 @@ public class RuleSetTest {
         assertThat(error.getMsg(), containsString("java.lang.IllegalStateException: Test exception while applying rule\n"));
         assertThat(error.getMsg(), containsString("Rule applied on node=dummyRootNode[@Image=Foo]"));
         assertThat(error.getError().getCause(), instanceOf(IllegalStateException.class));
-        assertThat(FilenameUtils.normalize(error.getFile(), true), equalTo("samplefile.dummy"));
+        assertThat(IOUtil.normalizePath(error.getFile()), equalTo("samplefile.dummy"));
 
         assertThat(report.getViolations(), hasSize(1));
     }

pmd-core/src/test/java/net/sourceforge/pmd/ant/PMDTaskTest.java

@@ -11,7 +11,6 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 
-import org.apache.commons.io.IOUtils;
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.BuildFileRule;
 import org.junit.AfterClass;
@@ -24,6 +23,8 @@ import org.junit.rules.TestRule;
 
 import net.sourceforge.pmd.internal.Slf4jSimpleConfiguration;
 
+import net.sourceforge.pmd.util.IOUtil;
+
 public class PMDTaskTest {
 
     @Rule
@@ -89,7 +90,7 @@ public class PMDTaskTest {
         buildRule.executeTarget("testWithShortFilenames");
 
         try (InputStream in = new FileInputStream("target/pmd-ant-test.txt")) {
-            String actual = IOUtils.toString(in, StandardCharsets.UTF_8);
+            String actual = IOUtil.readToString(in, StandardCharsets.UTF_8);
             // remove any trailing newline
             actual = actual.trim();
             Assert.assertEquals("sample.dummy:1:\tSampleXPathRule:\tTest Rule 2", actual);
@@ -102,11 +103,11 @@ public class PMDTaskTest {
 
         try (InputStream in = new FileInputStream("target/pmd-ant-xml.xml");
              InputStream expectedStream = PMDTaskTest.class.getResourceAsStream("xml/expected-pmd-ant-xml.xml")) {
-            String actual = IOUtils.toString(in, StandardCharsets.UTF_8);
+            String actual = IOUtil.readToString(in, StandardCharsets.UTF_8);
             actual = actual.replaceFirst("timestamp=\"[^\"]+\"", "timestamp=\"\"");
             actual = actual.replaceFirst("\\.xsd\" version=\"[^\"]+\"", ".xsd\" version=\"\"");
 
-            String expected = IOUtils.toString(expectedStream, StandardCharsets.UTF_8);
+            String expected = IOUtil.readToString(expectedStream, StandardCharsets.UTF_8);
             expected = expected.replaceFirst("timestamp=\"[^\"]+\"", "timestamp=\"\"");
             expected = expected.replaceFirst("\\.xsd\" version=\"[^\"]+\"", ".xsd\" version=\"\"");
 

pmd-core/src/test/java/net/sourceforge/pmd/cli/CoreCliTest.java

@@ -20,7 +20,6 @@ import java.nio.file.FileSystems;
 import java.nio.file.Files;
 import java.nio.file.Path;
 
-import org.apache.commons.io.IOUtils;
 import org.hamcrest.Matcher;
 import org.junit.AfterClass;
 import org.junit.Before;
@@ -34,6 +33,7 @@ import org.junit.rules.TemporaryFolder;
 import net.sourceforge.pmd.PMD;
 import net.sourceforge.pmd.PMD.StatusCode;
 import net.sourceforge.pmd.internal.Slf4jSimpleConfiguration;
+import net.sourceforge.pmd.util.IOUtil;
 
 /**
  *
@@ -135,7 +135,7 @@ public class CoreCliTest {
         runPmdSuccessfully("--no-cache", "--dir", srcDir, "--rulesets", DUMMY_RULESET, "--report-file", reportFile, "--debug");
 
         assertTrue("Report file should have been created", Files.exists(reportFile));
-        String reportText = IOUtils.toString(Files.newBufferedReader(reportFile, StandardCharsets.UTF_8));
+        String reportText = IOUtil.readToString(Files.newBufferedReader(reportFile, StandardCharsets.UTF_8));
         assertThat(reportText, not(containsStringIgnoringCase("error")));
     }
 

pmd-core/src/test/java/net/sourceforge/pmd/cpd/CPDFilelistTest.java

@@ -7,11 +7,11 @@ package net.sourceforge.pmd.cpd;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 
+import java.nio.file.Paths;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 
-import org.apache.commons.io.FilenameUtils;
 import org.junit.Test;
 
 public class CPDFilelistTest {
@@ -28,7 +28,7 @@ public class CPDFilelistTest {
         assertEquals(2, paths.size());
         Set<String> simpleNames = new HashSet<>();
         for (String path : paths) {
-            simpleNames.add(FilenameUtils.getName(path));
+            simpleNames.add(Paths.get(path).getFileName().toString());
         }
         assertTrue(simpleNames.contains("anotherfile.dummy"));
         assertTrue(simpleNames.contains("somefile.dummy"));
@@ -46,7 +46,7 @@ public class CPDFilelistTest {
         assertEquals(2, paths.size());
         Set<String> simpleNames = new HashSet<>();
         for (String path : paths) {
-            simpleNames.add(FilenameUtils.getName(path));
+            simpleNames.add(Paths.get(path).getFileName().toString());
         }
         assertTrue(simpleNames.contains("anotherfile.dummy"));
         assertTrue(simpleNames.contains("somefile.dummy"));

pmd-core/src/test/java/net/sourceforge/pmd/cpd/CpdXsltTest.java

@@ -17,10 +17,11 @@ import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.stream.StreamResult;
 import javax.xml.transform.stream.StreamSource;
 
-import org.apache.commons.io.IOUtils;
 import org.junit.Assert;
 import org.junit.Test;
 
+import net.sourceforge.pmd.util.IOUtil;
+
 
 public class CpdXsltTest {
     /* Sample ant build.xml file. Run with "ant cpdxsl".
@@ -49,7 +50,7 @@ public class CpdXsltTest {
         transformer.setErrorListener(errorListener);
         transformer.transform(cpdReport, result);
 
-        String expected = IOUtils.toString(CpdXsltTest.class.getResourceAsStream("ExpectedCpdHtmlReport.html"), StandardCharsets.UTF_8);
+        String expected = IOUtil.readToString(CpdXsltTest.class.getResourceAsStream("ExpectedCpdHtmlReport.html"), StandardCharsets.UTF_8);
         Assert.assertEquals(expected, result.getWriter().toString());
         Assert.assertTrue("XSLT errors occured: " + errorListener, errorListener.hasNoErrors());
     }

pmd-core/src/test/java/net/sourceforge/pmd/document/DocumentFileTest.java

@@ -16,12 +16,13 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 
-import org.apache.commons.io.IOUtils;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TemporaryFolder;
 
+import net.sourceforge.pmd.util.IOUtil;
+
 public class DocumentFileTest {
 
     private static final String FILE_PATH = "psvm.java";
@@ -51,8 +52,8 @@ public class DocumentFileTest {
 
     @Test
     public void shouldPreserveNewlines() throws IOException {
-        final String testFileContent = IOUtils.toString(
-                DocumentFileTest.class.getResource("ShouldPreserveNewlines.java"), StandardCharsets.UTF_8);
+        final String testFileContent = IOUtil.readToString(
+                DocumentFileTest.class.getResourceAsStream("ShouldPreserveNewlines.java"), StandardCharsets.UTF_8);
         writeContentToTemporaryFile(testFileContent);
 
         try (DocumentFile documentFile = new DocumentFile(temporaryFile, StandardCharsets.UTF_8)) {

pmd-core/src/test/java/net/sourceforge/pmd/renderers/AbstractRendererTest.java

@@ -13,8 +13,6 @@ import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
 import java.util.function.Consumer;
 
-import org.apache.commons.io.FileUtils;
-import org.apache.commons.io.IOUtils;
 import org.junit.Test;
 import org.junit.rules.TemporaryFolder;
 
@@ -32,6 +30,7 @@ import net.sourceforge.pmd.lang.ast.Node;
 import net.sourceforge.pmd.lang.rule.ParametricRuleViolation;
 import net.sourceforge.pmd.reporting.FileAnalysisListener;
 import net.sourceforge.pmd.reporting.GlobalAnalysisListener;
+import net.sourceforge.pmd.util.IOUtil;
 import net.sourceforge.pmd.util.datasource.DataSource;
 
 public abstract class AbstractRendererTest {
@@ -126,7 +125,7 @@ public abstract class AbstractRendererTest {
      */
     protected String readFile(String relativePath) {
         try (InputStream in = getClass().getResourceAsStream(relativePath)) {
-            return IOUtils.toString(in, StandardCharsets.UTF_8);
+            return IOUtil.readToString(in, StandardCharsets.UTF_8);
         } catch (IOException e) {
             throw new RuntimeException(e);
         }
@@ -221,7 +220,7 @@ public abstract class AbstractRendererTest {
             throw new AssertionError(e);
         }
 
-        return FileUtils.readFileToString(file, expectedEncoding);
+        return IOUtil.readFileToString(file, expectedEncoding);
     }
 
 }

pmd-core/src/test/java/net/sourceforge/pmd/renderers/SarifRendererTest.java

@@ -18,7 +18,6 @@ import net.sourceforge.pmd.Report;
 import net.sourceforge.pmd.Rule;
 import net.sourceforge.pmd.reporting.FileAnalysisListener;
 
-
 public class SarifRendererTest extends AbstractRendererTest {
 
     @org.junit.Rule