Android Transaction Commit

ID

kotlin.android_transaction_commit

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Kotlin

Tags

CWE:404, android, reliability

Description

Reports a local FragmentTransaction obtained via beginTransaction() that is never completed with commit(), commitAllowingStateLoss(), commitNow(), or commitNowAllowingStateLoss() within the same function body.

Rationale

fun bad(fm: FragmentManager) {
    val ft = fm.beginTransaction()     // FLAW
    ft.replace(R.id.host, frag)
}

fun good(fm: FragmentManager) {
    val ft = fm.beginTransaction()
    ft.replace(R.id.host, frag)
    ft.commit()
}

An unconfirmed FragmentTransaction is a no-op — the staged operations never reach the FragmentManager and the screen never updates. The pattern is almost always a forgotten call or a refactor regression.

Remediation

  • Call commit() (or one of its commitNow / AllowingStateLoss variants) before the function returns.

  • Wrap the transaction in try/finally if the calling code can throw, to ensure the commit always runs.

  • If the transaction is intentionally handed off to other code, store it in a field, return it, or pass it as an argument — those flows suppress the rule.

References