On some websites certain scripts must be temporarily allowed in order to get past the captchas. After I get past the captcha I disable those temp permissions.

When doing that I see the allow/disallow canvas icon show up in the address bar.

How exactly does TOR deal with canvvassing to protect my privacy?

For now I have installed the CanvasBlocker extension manually from an .xpi file, and it does show that it is blocking canvas while the mentioned scripts are allowed.