If a user used a link from a mail to navigate to the Confluence, the URL is like the below:

https://confluence.example.com/pages/viewpage.action?pageId=123456&preview=example.pptx&src=mail&src.mail.product=confluence-server&src.mail.timestamp=160612345679&src.mail.notification=com.atlassian.confluence.plugins.confluence-file-notifications%3Afile-content-update-notification&src.mail.recipient=XYZWe&src.mail.action=view

The src= part of the URL is created false-positive XSS alerts in the security systems as the XSS attacks can include some strings in the URLs like this:

<script src=http://ha.ckers.org/xss.js></script>

So replacing the src= with something like utm_source (or utm_media, etc.) that is used for the same purpose but considered safe and is a technical standard for tracking requests, would be better from the security point of view.