According to http://www.ietf.org/rfc/rfc2617.txt section 2, in basic
HTTP authentication the password can be any character (including newline).

urllib does the following:

_passwdprog = re.compile('^([^:]*):(.*)$')

That should be changed to:

_passwdprog = re.compile('^([^:]*):(.*)$', re.S)

otherwise newlines will not be caught by the second part of the regex,
and bad things are produced.

For a password with regular chars in it:

> python -c "import urllib; print urllib.splitpasswd('user:ab')"
('user', 'ab')

For a password with a newline:
> python -c "import urllib; print urllib.splitpasswd('user:a\nb')"
('user:a\nb', None)

The expected result should have been ('user', 'a\nb')

Inline test included in the patch.

Verified the patch. Added unittest.
Can be applied against the trunk (py27) and py3k (3.1)

looks good to me

Fixed.