Disable the jar: protocol for external resources via preference
We should add a preference that controls whether remote .jar files are opened by Tor Browser's jar: protocol handler and set the default value to not allow such actions.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information