Baidu is not doing anything wrong. The HTTP requests/responses are hijacked.

Baidu could make a switch to only support HTTPS though. That would require a more elaborate attack.