Update this part of the TB design doc
https://www.torproject.org/projects/torbrowser/design/#other-security
network.jar.block-remote-files is set to true. Mozilla tried to block remote JAR files in Firefox 45 but needed to revert that decision due to breaking IBM's iNotes. While Mozilla is working on getting this disabled again we take the protective stance already now and block remote JAR files even on the low security level.Since https://bugzilla.mozilla.org/show_bug.cgi?id=1329336 has been fixed
(See https://bugzilla.mozilla.org/show_bug.cgi?id=1427726 as well but that's for the future 67 ESR.)
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information