[P3][security] scripts/poll_dashboard_scan.py: nosec B310 lacks URL scheme validation (same class as #517)

[FabioLeitao]

Context

Issue #517 fixed utils/notify.py: the # nosec B310 comment claimed "caller
validates scheme" but no validation existed. Fix added _validate_webhook_url().

Same pattern exists in scripts/poll_dashboard_scan.py — two urlopen calls with
# nosec B310 but no scheme validation:

# scripts/poll_dashboard_scan.py — get_json() and post_json()
with urllib.request.urlopen(req, timeout=60) as r:  # nosec B310

The --base / DATA_BOAR_BASE argument accepts any URL (default:
http://127.0.0.1:8088). No if parsed.scheme not in {"http", "https"} guard.

Contrast with fixed files

File	nosec B310	Scheme validation
utils/notify.py	✅ fixed by #517	_validate_webhook_url() → raises on non-https
scripts/ops_notify.py	✅	if parsed.scheme != "https": raise (line 34)
scripts/check_name_availability.py	✅	URL hardcoded as https://pypi.org/...
scripts/sonar_issues.py	partial	defaults to https://sonarcloud.io but env-var not validated
scripts/poll_dashboard_scan.py	❌	no validation — localhost default but accepts any --base

Risk

Low — dev/ops helper, not product code, operator-controlled input. But the
nosec justification is technically false (same as old notify.py), misleads
reviewers, and creates a pattern inconsistency with the already-fixed files.

Suggested fix

In scripts/poll_dashboard_scan.py, add before the first urlopen in both
get_json() and post_json():

import urllib.parse
_parsed = urllib.parse.urlparse(base)
if _parsed.scheme not in {"http", "https"}:
    raise ValueError(f"Unsupported scheme '{_parsed.scheme}' in base URL '{base}'")

Or extract a shared _validate_base_url(base: str) called once in main().

Update # nosec B310 comment to # nosec B310 — scheme validated above.

Acceptance criteria

• URL scheme validated before urlopen in both get_json() and post_json()
• # nosec B310 comment updated to reflect true justification
• uv run bandit -r . -c pyproject.toml -ll -ii still passes
• Script behaviour unchanged for valid http:// and https:// URLs

Out of scope

• scripts/sonar_issues.py — separate issue if operator wants to address
• Changing product code (utils/notify.py already fixed)

[FabioLeitao]

Opened by Claude (readonly auditor) — Cursor implements if needed.

[FabioLeitao]

Confirmado: ainda válida, não superada

scripts/poll_dashboard_scan.py: dois # nosec B310 em urllib.request.urlopen, sem checagem de scheme de URL visível antes.

Verificado via A.I.I.D.C.O.B.P.P. v1.4 — Claude (Sonnet 5), auditor externo.