I've done several oxalic acid baths. Works great but can be a bit of a hassle. It's sold as wood bleach at many hardware stores, comes in powder form. I by Savogram brand wood bleach from my local Ace Hardware. About $10 for a pint size container that will last a while. Mix about a tablespoon or slightly more per gallon. I get cheap inflatable kid pool (seasonal item, sometimes hard to find this time of year) and fill it with the mixture then let the frames soak for a day or two depending on how bad the rust is. It shouldn't hurt the paint or decals but can leave a slight film if you leave it in too long or have too strong a concentration. Great for treating rust inside and out. you can also toss in all the steel parts, nuts, bolts, etc. (just not alloy parts) to de-rust those as well. But it is toxic stuff and you should avoid skin/eye contact.

Another alternative is to get a de-ruster and fill the bike. I just did this over the last weekend and worked great. I used Evaporust. Less toxic and biodegradable. Purchased the large (gallon?) size bottle from an auto parts store for $25 and used about a third of it. Bought some rubber plugs from a hardware store for about $5, and plugged the BB shell and head tube. Plugged all the drain holes, water bottle cage mounts, dt shifter mounts, BB cable guide hole, etc., then filled the frame from the seat tube. If you are only concerned about a thin rust layer inside the tubes, this is what I would recommend.