You are probably confusing Java and JavaScript. Java is not allowed on Tor Browser Bundle and shouldn't be allowed in a browser, ever. (And probably in general

You are probably confusing Java and JavaScript. Java is not allowed on Tor Browser Bundle and shouldn't be allowed in a browser, ever. (And probably in general if you care about security.) JavaScript in general should not be that dangerous - however, there was a 0-day bug in Firefox, that Tor Browser used, that leaked the IP anyway, and NSA used that 0-day. In general - at least in my opinion - JavaScript is much lower on the "dangerous" list than Java, but yeah, still can leak something. The best way is probably to just use Tails - a linux distro made to be secure from the start.