If I understand correctly, there is almost no way to stop this attack because it uses client side JavaScript code. If Baidu doesn't remove this malicious js from its http response, github will continue to suffer.
Baidu could make a switch to only support HTTPS though. That would require a more elaborate attack.