fix(server-renderer): render className as escaped string

[edison1105]

see #11722 (comment)

Summary by CodeRabbit

• Bug Fixes
  • Server-side rendering: adjusted how class attributes are formatted when multiple class values are provided—array-style values are now rendered with comma-separated formatting instead of space-separated, aligning SSR output with the updated rendering behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 18a7e35 and a2af9af.

📒 Files selected for processing (1)

• packages/server-renderer/src/helpers/ssrRenderAttrs.ts

---

📝 Walkthrough

Walkthrough

The PR changes SSR attribute rendering by treating className separately from class: className values are now coerced to strings and HTML-escaped directly, while class still uses existing normalization via ssrRenderClass. Tests updated to reflect comma-joined array rendering for className.

Changes

Cohort / File(s)	Summary
SSR className Attribute Handling packages/server-renderer/src/helpers/ssrRenderAttrs.ts, packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts	Introduces a dedicated branch for className that uses String() + escapeHtml() for non-null values (bypassing ssrRenderClass), and updates tests to expect comma-separated rendering for array inputs. Other attribute flows unchanged.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(server-renderer): use ssrRenderClass helper for className attribute #14327: Modifies ssrRenderAttrs.ts handling for className (opposite approach — routes className through ssrRenderClass to preserve space-separated array rendering).

Suggested reviewers

• skirtles-code
• KazariEX

Poem

🐰 I hop through attrs with a tiny cheer,
class stays tidy, className changed gear,
Arrays now join with a curious comma,
Escaped and stringified — quick as a stoma,
A little rabbit applauds this new steer.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: fixing the server-renderer to handle className by rendering it as an escaped string instead of formatting it through ssrRenderClass.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch edison/fix/SSRclassName

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Size Report

Bundles

File	Size	Gzip	Brotli
runtime-dom.global.prod.js	104 kB	39.3 kB	35.4 kB
vue.global.prod.js	162 kB	59.3 kB	52.7 kB

Usages

Name	Size	Gzip	Brotli
createApp (CAPI only)	47.8 kB	18.6 kB	17.1 kB
createApp	56 kB	21.7 kB	19.8 kB
createSSRApp	60.2 kB	23.4 kB	21.4 kB
defineCustomElement	61.6 kB	23.4 kB	21.4 kB
overall	70.4 kB	27 kB	24.6 kB

[pkg-pr-new]

Open in StackBlitz

@vue/compiler-core

pnpm add https://pkg.pr.new/@vue/compiler-core@14469

npm i https://pkg.pr.new/@vue/compiler-core@14469

yarn add https://pkg.pr.new/@vue/compiler-core@14469.tgz

@vue/compiler-dom

pnpm add https://pkg.pr.new/@vue/compiler-dom@14469

npm i https://pkg.pr.new/@vue/compiler-dom@14469

yarn add https://pkg.pr.new/@vue/compiler-dom@14469.tgz

@vue/compiler-sfc

pnpm add https://pkg.pr.new/@vue/compiler-sfc@14469

npm i https://pkg.pr.new/@vue/compiler-sfc@14469

yarn add https://pkg.pr.new/@vue/compiler-sfc@14469.tgz

@vue/compiler-ssr

pnpm add https://pkg.pr.new/@vue/compiler-ssr@14469

npm i https://pkg.pr.new/@vue/compiler-ssr@14469

yarn add https://pkg.pr.new/@vue/compiler-ssr@14469.tgz

@vue/reactivity

pnpm add https://pkg.pr.new/@vue/reactivity@14469

npm i https://pkg.pr.new/@vue/reactivity@14469

yarn add https://pkg.pr.new/@vue/reactivity@14469.tgz

@vue/runtime-core

pnpm add https://pkg.pr.new/@vue/runtime-core@14469

npm i https://pkg.pr.new/@vue/runtime-core@14469

yarn add https://pkg.pr.new/@vue/runtime-core@14469.tgz

@vue/runtime-dom

pnpm add https://pkg.pr.new/@vue/runtime-dom@14469

npm i https://pkg.pr.new/@vue/runtime-dom@14469

yarn add https://pkg.pr.new/@vue/runtime-dom@14469.tgz

@vue/server-renderer

pnpm add https://pkg.pr.new/@vue/server-renderer@14469

npm i https://pkg.pr.new/@vue/server-renderer@14469

yarn add https://pkg.pr.new/@vue/server-renderer@14469.tgz

@vue/shared

pnpm add https://pkg.pr.new/@vue/shared@14469

npm i https://pkg.pr.new/@vue/shared@14469

yarn add https://pkg.pr.new/@vue/shared@14469.tgz

vue

pnpm add https://pkg.pr.new/vue@14469

npm i https://pkg.pr.new/vue@14469

yarn add https://pkg.pr.new/vue@14469.tgz

@vue/compat

pnpm add https://pkg.pr.new/@vue/compat@14469

npm i https://pkg.pr.new/@vue/compat@14469

yarn add https://pkg.pr.new/@vue/compat@14469.tgz

commit: a2af9af

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts (1)

147-158: ⚠️ Potential issue | 🔴 Critical

Add test coverage for null, undefined, and object className values to expose implementation bugs

The className test block only covers string and array cases. However, the implementation uses String(value) without filtering, which causes critical issues:

• className: null renders as class="null" (should be ignored or empty)
• className: undefined renders as class="undefined" (should be ignored or empty)
• className: { foo: true } renders as class="[object Object]" (should be ignored or empty)

Add explicit tests to expose these bugs:

expect(ssrRenderAttrs({ className: null })).toBe(``)
expect(ssrRenderAttrs({ className: undefined })).toBe(``)
expect(ssrRenderAttrs({ className: {} })).toBe(``)

After adding tests, the implementation at ssrRenderAttrs.ts line 49-52 needs fixing to validate values before rendering, similar to how ssrRenderDynamicAttr uses isRenderableAttrValue().

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts` around lines 147 -
158, The className rendering tests miss null/undefined/object cases and the
ssrRenderAttrs implementation currently uses String(value) unconditionally,
causing invalid outputs; update ssrRenderAttrs to validate values before
rendering (use the same check logic as ssrRenderDynamicAttr with
isRenderableAttrValue) so that falsy/non-renderable className values (null,
undefined, objects) are ignored and return an empty string, and add tests
asserting ssrRenderAttrs({ className: null }) === ``, ssrRenderAttrs({
className: undefined }) === ``, and ssrRenderAttrs({ className: {} }) === `` to
lock in the behavior.

🧹 Nitpick comments (1)

packages/server-renderer/src/helpers/ssrRenderAttrs.ts (1)

52-52: String(value) call is redundant

escapeHtml already accepts unknown and internally does '' + string (string coercion), so escapeHtml(String(value)) is equivalent to escapeHtml(value). The explicit String() wrap adds no behaviour and can be dropped.

♻️ Proposed simplification

-      ret += ` class="${escapeHtml(String(value))}"`
+      ret += ` class="${escapeHtml(value)}"`

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/server-renderer/src/helpers/ssrRenderAttrs.ts` at line 52, The
template concatenation is calling String(value) redundantly before escapeHtml;
update the ssrRenderAttrs code that builds the class attribute (the expression
ret += ` class="${escapeHtml(String(value))}"`) to pass the raw value to
escapeHtml (i.e., use escapeHtml(value)) and remove the unnecessary String(...)
wrapper so the class rendering uses escapeHtml directly.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/server-renderer/src/helpers/ssrRenderAttrs.ts`:
- Around line 49-52: In ssrRenderAttrs's className branch, guard against
null/undefined so you don't emit class="null" or "undefined": in the branch that
handles key === 'className' (in ssrRenderAttrs), only coerce and append the
attribute when value is not null/undefined (e.g., value != null); otherwise skip
adding the class attribute (or append an empty class string consistent with
ssrRenderClass behavior). Update/add tests to cover className: null and
className: undefined to assert no literal "null"/"undefined" is emitted.

---

Outside diff comments:
In `@packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts`:
- Around line 147-158: The className rendering tests miss null/undefined/object
cases and the ssrRenderAttrs implementation currently uses String(value)
unconditionally, causing invalid outputs; update ssrRenderAttrs to validate
values before rendering (use the same check logic as ssrRenderDynamicAttr with
isRenderableAttrValue) so that falsy/non-renderable className values (null,
undefined, objects) are ignored and return an empty string, and add tests
asserting ssrRenderAttrs({ className: null }) === ``, ssrRenderAttrs({
className: undefined }) === ``, and ssrRenderAttrs({ className: {} }) === `` to
lock in the behavior.

---

Nitpick comments:
In `@packages/server-renderer/src/helpers/ssrRenderAttrs.ts`:
- Line 52: The template concatenation is calling String(value) redundantly
before escapeHtml; update the ssrRenderAttrs code that builds the class
attribute (the expression ret += ` class="${escapeHtml(String(value))}"`) to
pass the raw value to escapeHtml (i.e., use escapeHtml(value)) and remove the
unnecessary String(...) wrapper so the class rendering uses escapeHtml directly.

---

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 09dec96 and 18a7e35.

📒 Files selected for processing (2)

• packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts
• packages/server-renderer/src/helpers/ssrRenderAttrs.ts