fix(server-renderer): use ssrRenderClass helper for className attribute

edison1105 · edison1105 · commit 9ddfe25bc703 · 2026-01-16T17:20:53.000+08:00
fix https://github.com/vuejs/core/security/advisories/GHSA-5c3j-59mh-x5gj
diff --git a/packages/server-renderer/src/helpers/ssrRenderAttrs.ts b/packages/server-renderer/src/helpers/ssrRenderAttrs.ts
@@ -43,7 +43,7 @@ export function ssrRenderAttrs(
     } else if (key === 'style') {
       ret += ` style="${ssrRenderStyle(value)}"`
     } else if (key === 'className') {
-      ret += ` class="${String(value)}"`
+      ret += ` class="${ssrRenderClass(value)}"`
     } else {
       ret += ssrRenderDynamicAttr(key, value, tag)
     }

Original file line number	Diff line number	Diff line change
`@@ -43,7 +43,7 @@ export function ssrRenderAttrs(`
`43`	`43`	`} else if (key === 'style') {`
`44`	`44`	ret += ` style="${ssrRenderStyle(value)}"`
`45`	`45`	`} else if (key === 'className') {`
`46`		- ret += ` class="${String(value)}"`
	`46`	+ ret += ` class="${ssrRenderClass(value)}"`
`47`	`47`	`} else {`
`48`	`48`	`ret += ssrRenderDynamicAttr(key, value, tag)`
`49`	`49`	`}`