why is kses removing semicolon from inline style?

Question

I have a validation function that uses wp_kses, and it works as expected to remove code from the input if it is relatively simple code HOWEVER using kses is also removing semicolons from inline styles. (in <h1 style="color: red;">the name</h1>, the semicolon after the word 'red' is removed)

Documentation makes no mention of this behavior, is it a bug? My actual code using kses is below. Can anyone tell me how to change my code so that kses does not remove the semicolon?

function sanitize_name($valid, $value, $field, $input) {

    if( $valid !== true ) {
        return $valid;
    }

    $allowed = array( 
        'h1' => array(
            'style' => array(),
        ),
        'h2' => array(),
        'h3' => array(),
        'h4' => array(),
        'h5' => array(),
        'h6' => array(),
        'p' => array(),
        'br' => array(),
        'strong' => array(),
        'b' => array(),
        'em' => array(),
        'ul' => array(),
        'li' => array(),
        'ol' => array(),
        'div' => array(),
        'span' => array(),
        'pre' => array(),
        'button' => array(),
        'svg' => array(),
        'blockquote' => array(),
        'a' => array(),
        'i' => array(),
        'sup' => array(),
        'sub' => array()
    );

    $value2 = wp_kses( $value, $allowed );

    
    if ( strcmp( stripslashes( $value ), $value2) !== 0 ) {
        return 'Please remove the disallowed HTML from this field to submit.<br />
        Entered:' . stripslashes($value) . '<br />
        Cleaned:<br />' . $value2;
    }

    return $valid;
}

Answer 1

There are no signs that this was accidental or a bug, and has been in core for many years. This is because of this set of lines at the end of the main loop of safecss_filter_attr:

            // Only add the CSS part if it passes the regex check.
            if ( $allow_css ) {
                if ( '' !== $css ) {
                    $css .= ';';
                }

                $css .= $css_item;
            }

The root of the question is a broken assumption that wp_kses modifies the original HTML string, which is not the case.

Instead, wp_kses uses regular expressions to break apart your HTML into arrays which are then further subdivided by more regular expressions. It's these arrays that are then going to be processed to remove attributes and tags etc. Then these are reassembled to create a brand new HTML string.