Legal, yes. Annoying, maybe. You could limit your liability by only allowing scanning of the origin IP, i.e. don't allow the entry of any IP the user wants to enter. That way, the visitor is scanning only his own machine, no one else's.