A java application I'm working on has a file upload component, and I want to validate that only certain file types are allowed. I realize checking file extension alone is not sufficiently reliable, so I've started validating the hex signatures of the uploaded files. Have been using this for reference: http://www.garykessler.net/library/file_sigs.html
So, this application will expect some OOXML files, but it seems that each of these (docx, pptx, xlsx) have the same hex signature (50 4B 03 04 14 00 06 00), with no subheader to differentiate them.
Is there a good way to differentiate these, or, should I implement it whereby if the file extension is an OOXML file we accept, and the shared hex sig is correct, allow it through? Are there any additional security concerns from implementing the latter?