From 97f43fbd4f9b05fea5e6ce57e72226bc10fd12a5 Mon Sep 17 00:00:00 2001
From: Varun Chawla <varun_6april@hotmail.com>
Date: Sat, 7 Feb 2026 23:08:45 -0800
Subject: [PATCH] Fix .pgpass file to properly de-escape backslash escapes

According to PostgreSQL documentation, backslashes in .pgpass files
serve to escape backslashes and colons, and are not part of the value.
Previously, asyncpg left escaped values as-is (e.g., `4\:K1` stayed
`4\:K1` instead of becoming `4:K1`), which caused authentication
failures when passwords contained colons.

This fix properly de-escapes:
- `\:` becomes `:`
- `\\` becomes `\`

Fixes #1249
---
 asyncpg/connect_utils.py |  9 +++++++--
 tests/test_connect.py    | 11 ++++++-----
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/asyncpg/connect_utils.py b/asyncpg/connect_utils.py
index 07c4fdde..4c996fad 100644
--- a/asyncpg/connect_utils.py
+++ b/asyncpg/connect_utils.py
@@ -123,10 +123,15 @@ def _read_password_file(passfile: pathlib.Path) \
                     continue
                 # Backslash escapes both itself and the colon,
                 # which is a record separator.
+                # First, temporarily replace \\ with a placeholder
                 line = line.replace(R'\\', '\n')
+                # Split on unescaped colons
+                parts = re.split(r'(?<!\\):', line, maxsplit=4)
+                # De-escape: replace \n (placeholder for \\) with \
+                # and \: with :
                 passtab.append(tuple(
-                    p.replace('\n', R'\\')
-                    for p in re.split(r'(?<!\\):', line, maxsplit=4)
+                    p.replace('\n', '\\').replace(R'\:', ':')
+                    for p in parts
                 ))
     except IOError:
         pass
diff --git a/tests/test_connect.py b/tests/test_connect.py
index 955fb825..f22f821a 100644
--- a/tests/test_connect.py
+++ b/tests/test_connect.py
@@ -1514,18 +1514,19 @@ def test_connect_pgpass_regular(self):
                 )
             })
 
-            # test escaping
+            # test escaping - values should be de-escaped
+            # \: becomes : and \\ becomes \
             self.run_testcase({
                 'host': 'fgh',
-                'user': R'test\\',
-                'database': R'test\:db',
+                'user': R'test\',
+                'database': R'test:db',
                 'passfile': passfile.name,
                 'result': (
                     [('fgh', 5432)],
                     {
                         'password': 'password from pgpass with escapes',
-                        'user': R'test\\',
-                        'database': R'test\:db',
+                        'user': R'test\',
+                        'database': R'test:db',
                         'target_session_attrs': 'any',
                     }
                 )