According to http://www.ietf.org/rfc/rfc2617.txt section 2, in basic
HTTP authentication the password can be any character (including newline).

urllib does the following:

_passwdprog = re.compile('^([^:]*):(.*)$')

That should be changed to:

_passwdprog = re.compile('^([^:]*):(.*)$', re.S)

otherwise newlines will not be caught by the second part of the regex,
and bad things are produced.

For a password with regular chars in it:

> python -c "import urllib; print urllib.splitpasswd('user:ab')"
('user', 'ab')

For a password with a newline:
> python -c "import urllib; print urllib.splitpasswd('user:a\nb')"
('user:a\nb', None)

The expected result should have been ('user', 'a\nb')