How to make sure that only files I generated pass?

I have the following situation: I have an app on a User device, and my main server. The app can send the main server pdf-files and jpg-files. Now my problems are:

-> What is the best way for the server to make sure that only pdf-files and jpg-files arrive?

-> What is the best way for the server to make sure that only files generated from the app arrive, and no user generated files? If the user can generate his own files, he can add malicious content which I don't want to have on my server.

My app is running on a possibly open phone (rooted/jailbreaked), so I don't can be sure that no one has access to the storage folder of the app.

How can I solve this problem?